CEO Executive Assistant
The practical research question is: What should an executive assistant verify before routing a new payment instruction or vendor bank-account change for approval?
This review uses current primary and authoritative guidance checked on 2026-10-02. The FBI warns that business email compromise commonly uses fraudulent payment instructions, and FTC guidance recommends independently verified controls for sensitive business information. GAO internal-control standards emphasize segregation of duties and documented control activities.
Start with an outcome that another person can inspect. For this workflow, record vendor record, request source, requested change, invoice reference, known contact channel, independent verifier, verification time, preparer, approver, payment releaser, exception reason, and reconciliation result.
Consider this scenario: A familiar vendor thread contains a new bank account, a same-day deadline, and a request not to call because the representative is traveling. The wording and signature look normal.
- Business Email Compromise: Federal Bureau of Investigation; checked 2026-10-02.
- Protecting Personal Information: A Guide for Business: Federal Trade Commission; checked 2026-10-02.
- Standards for Internal Control in the Federal Government: U.S. Government Accountability Office; checked 2026-10-02.
Read the primary guidance as a control problem
The FBI describes business email compromise as a fraud that often relies on compromised accounts, impersonation, and requests to redirect legitimate payments. A familiar display name, a correct invoice, and knowledge of an executive relationship can therefore coexist with a fraudulent instruction. Evidence has to come from outside the message chain. Even a technically authentic email may originate from a compromised account, so email authentication alone cannot approve a bank change.
The Federal Trade Commission’s information-security guidance supports limiting access to sensitive records and planning how they are protected and disposed of. A payment-change workflow should avoid copying bank details into executive chat, calendar notes, or an assistant’s private checklist. The working record can show that independent verification succeeded, who performed it, and when, while the financial system retains the protected account data.
The Government Accountability Office’s internal-control framework separates authorization, documentation, segregation of duties, and review. In a CEO office, the person who receives or coordinates an urgent request should not silently become the verifier, approver, and releaser. A small team can still separate stages by requiring finance to own the vendor record and payment release while the assistant coordinates the known-contact callback.
Handle an attempted diversion
Imagine that a supplier’s controller emails the CEO near quarter-end. The message refers to a real project, attaches a valid invoice, and says the supplier has changed banks after a merger. It asks for payment that afternoon and supplies a new callback number. The assistant recognizes the controller’s name and writing style, but none of that proves control of the mailbox.
The assistant logs the request without entering the new account, alerts finance through the approved channel, and retrieves the supplier contact from the pre-existing vendor record. The known controller does not answer. Procurement then reaches the contract owner, who confirms that no merger occurred. Finance freezes the change and invokes the incident process. The assistant preserves the original message but does not forward the bank details through broad internal lists.
The useful result is not merely “fraud prevented.” The team learns which signal worked, where the trusted contact path failed, and whether the vendor record needs a backup contact. If the account had truly changed, the same process would have protected the legitimate supplier from a misdirected payment.
Handle exceptions without inventing a shortcut
Some vendors cannot answer the trusted number because the original contact has left. Others use a payment platform that changes settlement accounts behind the scenes. These cases need more evidence, not an improvised exception. Ask the contract owner or procurement team to re-establish identity through records that predate the request. Confirm the new authorized contact, document how that authority was established, and only then begin the ordinary change process.
An executive may insist that a payment cannot wait. Present the actual choices: pay the previously verified account, delay while identity is rebuilt, or use a formally approved exception that finance and the appropriate risk owner can defend. Urgency does not prove the requester’s identity. If policy permits an exception, record its scope and reason without turning it into a reusable precedent.
International payments add practical complications. Time zones, language, correspondent banks, and local holidays can make confirmation slow. Plan for them during vendor onboarding. A delay discovered during an urgent change request is not a reason to trust the request; it is evidence that the organization needs a better verified contact path.
Reconcile the first payment and close the case
Approval is not the final control. Finance should compare the released instruction with the independently confirmed record, then reconcile the first payment against the intended vendor and invoice. Watch for a returned transfer, a vendor claiming nonreceipt, a second change request, or pressure to split the payment. Any of those signals should reopen the case and trigger the organization’s fraud-response procedure.
The closing record should answer a reviewer’s questions without reproducing the sensitive account: what changed, who requested it, which pre-existing source supplied the callback contact, who confirmed the change, who approved it, who released the payment, and what reconciliation showed. Retain that record according to financial and legal policy. Remove temporary copies from inboxes and working notes.
A sound workflow may feel slower than replying to an urgent email, but it protects both the company and the legitimate vendor. Its purpose is not to make fraud impossible through a checklist. Its purpose is to force a high-consequence instruction through independent identity evidence, distinct authority, and a traceable financial decision.
Compare the sources by the control each one contributes
The FBI’s business-email-compromise guidance explains the threat pattern: a legitimate-looking business conversation can be used to redirect money. It supports skepticism about the message itself, but it does not assign approval roles inside a particular company. The GAO framework supplies that organizational layer through authorization, documentation, and separation of duties. The FTC guidance adds a data-handling constraint: collecting evidence for the control should not scatter sensitive financial information across weakly governed tools.
Taken together, the sources support a workflow in which identity evidence, business approval, system entry, and release remain distinguishable. They do not imply that four people are always required. A small company might use an owner to establish the vendor relationship, finance to verify and enter the change, and a separate authorized person to release payment. What matters is that one compromised mailbox or one hurried employee cannot complete every consequential step without a visible exception.
Correct the vendor record after a legitimate change
When a change is genuine, update more than the account number. Record the effective date, legal entity, currency, payment method, remittance contact, and any invoices affected by the transition. Resolve invoices already queued against the old instruction one by one. A blanket change can incorrectly reroute a credit note, tax payment, or payment belonging to a related entity with a similar name.
Notify the vendor through the established business contact that the master record has been updated, without repeating full account details in the notice. Finance should retain the verified evidence in the controlled system and remove temporary documents from general collaboration spaces. If the vendor later disputes the update, the team needs a traceable record of who established authority and which instruction applied to each payment date.
Reconcile outcomes instead of treating release as success
Bank acceptance shows that a transfer entered the payment rail; it does not prove that the intended creditor received and applied it. Match the payment to the vendor’s remittance acknowledgment and the correct invoice. Investigate differences in amount, currency, beneficiary name, and settlement date. For a first payment after a master-data change, use a defined review window rather than waiting for the vendor’s collections team to report a missing balance.
If funds were misdirected, preserve the request, verification evidence, approval history, system changes, and bank references. Escalate through the organization’s incident and recovery channels immediately. The post-incident review should identify the failed control and correct it without publishing bank details to a broad lessons-learned audience.
Govern changes initiated inside a vendor portal
A portal notification can reduce email risk but does not automatically prove the change is legitimate. Determine who controls vendor users, whether strong authentication is required, and whether the portal records the actor and prior value. A compromised vendor account can submit a fraudulent change through the approved interface. High-consequence changes still need independent business verification and separated release.
When the company’s own portal allows self-service updates, send notice through an existing contact channel after submission and before activation. Preserve the audit event and any approval. If an administrator overrides the workflow, record the reason and subject the override to later review.
Measure whether the control operates under pressure
Sample completed changes for independent evidence, distinct roles, correct effective dates, and first-payment reconciliation. Include rejected and abandoned requests; they often reveal where staff encountered pressure or where the trusted contact record failed. Count exceptions by cause instead of celebrating a low average processing time.
Exercise the process with finance, procurement, and the executive office using a realistic but harmless scenario. The test should reveal whether people know where the authoritative vendor record lives and who can stop release. Correct the operating gap before changing the written policy.