IDENTIFY HIGH-RISK TASKS AND POWERS
STEP 2
To determine which tasks and powers associated with a role are risk-sensitive, it is important to consider whether performing, exercising, not performing or not exercising a task or power represents a certain value in economic transactions or for certain groups in society. This is because such tasks and powers are more susceptible to various forms of misuse.
An employee who has access to an organisation’s financial resources, for example when making payments on behalf of the organisation, may be tempted to misuse this power and may also be an attractive target for third parties, for example in phishing attempts. The value of this particular employee’s power can easily be determined from the volume of the money flows. That value is more difficult to express when it concerns an employee who manages databases containing sensitive data. Even something seemingly simple, such as issuing passports, can create an integrity risk because of the value that an authentic passport represents to criminals. Organisations must be alert to roles that involve working with customer data, such as addresses and citizen service numbers (BSNs), or with business-sensitive data or competitively sensitive information.
When considering high-risk tasks and powers, we should not only look outwards. Powers over other staff can also pose a risk. For example, this occurs when an employee’s role allows them to grant authorisations to other colleagues, or when a manager has the power to hire new colleagues.
Every role in an organisation may therefore involve different integrity risks. In the example used in this brochure – see the blue box above – the role of ‘sales representative’ involves both an internal and an external integrity risk. In the table, you first see the work area to which the role belongs, the specific situation in which integrity risks may arise and the possible risk associated with that situation.
| role name: | sales representative | |
| tasks: | selling products and services, identifying potential customers and sales markets in the Netherlands and abroad. | |
| work area | situation | possible risk |
| Contact with third parties | Employee is responsible for contact with and onboarding of new customers | Employee accepts a dishonest customer as a result of manipulation |
EXPLANATION
In this table, we focus on the risks that exist in the sales representative’s contacts with customers. In this example, the representative is responsible for customer retention and new client onboarding. Many organisations have an acceptance policy for new customers. One reason for this is to gain insight into the supply chain, to ensure you do not inadvertently contribute or associate with wrongdoing through that chain, for example. Other reasons include verifying that a new customer has the ability to meet long-term obligations, that they share the values to which the organisation is committed and that a new customer actually exists. In the example, one of the risks identified is that the representative is tempted or persuaded to accept customers who do not fit within the organisation’s acceptance policy. Another risk is that the representative offers existing customers an overly favourable rate that does not fit within the organisation’s policy. An overly close relationship with the customer, or certain benefits promised by the customer, could tempt the representative to do so.