Alignment: LO2 / A2 Objective: Design preventive and detective controls for a personal or small-business payment workflow.
Use only the simulated data supplied in this folder. Do not test live suspicious links, accounts, phone numbers or payment routes.
- Map the payment workflow from request to approval, authentication and settlement.
- Identify where sender identity, account details and payment purpose are verified.
- Add an independent callback for changed beneficiary or urgent payment requests.
- Set a maker-checker rule and escalation threshold for high-risk transfers.
- Choose notification, transfer-limit and Money Lock controls appropriate to the scenario.
- Document exceptions and who may approve them.
- Run the supplied fraudulent-invoice scenario through the revised workflow.
- Record the blocked point, remaining exposure and recovery options.
Payment control map, approval matrix and scenario test result.
The design separates request, verification and approval, and names at least one preventive and one detective control.
Which observable fact most changed your decision, and which uncertainty remains?