Modern reality makes the CFO role increasingly challenging. Finance leaders today juggle managing financial strategy, balancing investments, reporting to regulators, boards, and shareholders, all while performing these tasks in volatile markets. Additionally, they are being asked to reduce risk while navigating rapidly changing digital infrastructure.
And when it comes to risk management, there’s one area that still challenges even the most well-managed finance functions – internal risk. Not because it’s ignored, but because it hides in the daily actions of users, whom we trust to do the right thing and provide privileges across numerous business units and dozens of systems.
Of course, not every vulnerability leads to fraud. But under certain unfavorable circumstances, when excessive privileges meet motive, internal risk can lead to significant consequences. Unfortunately, such incidents continue to make headlines each year. In 2023, an Apple employee was sentenced for defrauding Apple of over $17 million through a supplier kickback scheme. At Macy’s, an accountant hid as much as $154M in expenses through unauthorized journal entries. Cases like this can delay financial reporting, raise audit flags, and negatively impact investor confidence.
Unauthorized expenses, falsified invoices, vendor manipulation – these challenges are not new, but the context in which they’re happening is. The modern business environment is interconnected, cloud-driven, and increasingly complex. According to Salesforce, the average number of apps in an enterprise grew from 843 in 2021 to 1,061 in 2023. Today, the average organization uses around 130 cloud-based applications, and large enterprises may have well over a thousand. Millions of transactions happen across these applications daily. With thousands of users performing these actions, traditional governance approaches make it impossible to ensure that none of them receives more privileges than they need. The risk that some users might receive rights allowing them to create vendors, modify payment records, approve payments, and perform other critical actions without clear oversight, has never been more significant. In today’s world of cloud applications with numerous interfaces between each, it’s difficult to understand the true process flow of data and determine how many of those need to be in scope for risk monitoring.
Compliance standards demand the elimination of Segregation of Duties (SoD) conflicts, yet identifying and resolving these violations across sprawling digital ecosystems remains a persistent challenge.
On top of that, regulators increasingly expect organizations to demonstrate not just that controls exist, but that they are effective across complex, dynamic environments. New regulations are also increasingly holding CFOs (and other C-suite executives) personally accountable for internal controls and risk management, making this responsibility even more important than ever.
But as digitalization introduces new risks, technology is also coming to the rescue. Technology can provide CFOs with visibility – mapping access and business processes across applications, predicting risky permissions and SoD conflicts before they arise, and monitoring transactional activity at scale.
Just as GPS brought transparency to logistics and fintech made personal banking auditable down to the transaction, GRC technology is beginning to give CFOs a new level of clarity inside their own systems, reducing the manual human factor while eliminating the lack of visibility to internal risk from the very beginning.
It includes real-time monitoring and cross-application risk detection, as well as traditional SoD and sensitive access reports seamlessly integrated into access reviews. As all data flows and transaction logs are consolidated and continuously analyzed, risks are flagged automatically – even before access is granted.
This evolution is already underway. As subject matter experts on the sensitivity of business applications, CFOs should work more closely with audit and IT teams to mitigate internal risk. By analyzing the entire application landscape and risky functionalities within it, defining access rules and control expectations, enforcing them, and monitoring compliance, the CFO themselves drive access compliance orchestration. IT supports infrastructure and access, but it is CFOs who bring the financial lens to operational integrity, enhancing business resilience.
Internal fraud will never go away completely, but it can be reduced dramatically and identified significantly faster. CFOs who embrace visibility as a core competency – not just a control measure – will not only mitigate risk but also unlock new levels of efficiency and trust in their organizations. This approach rewards them with consistency, financial integrity, and faster reporting, empowering organizations to respond confidently to auditors, regulators, and boards.
The author, Piyush Pandey, is CEO at Pathlock.