Practical notes with dated sources

Large customers are collecting emissions data for California's SB 253 and the EU's CSRD. What they may ask, what they will ask next, and how a supplier can answer once and reuse it.

Since 10 March 2026, one DOJ policy governs corporate self-disclosure in every criminal matter except antitrust. Its rewards go to companies that find problems first and report promptly, which takes capability built in advance.

FinCEN's final rule ended beneficial ownership reporting for US companies and US persons. Foreign reporting companies still file, banks still ask, New York has its own law, and buyers still want the chart.

An AI agent that can post, reconcile or route invoices is a system user. Give it its own identity, keep it inside your segregation of duties rules, cap what it can do alone and keep evidence an auditor can replay.

The 2024 Arup loss happened without a single system being breached. The defense is a written rule that no voice, face or message authorizes a payment on its own, backed by callbacks and dual release.

The UK offence counts your whole group toward its size test and turns on where the fraud touches the UK, not where you are incorporated. A US group with UK staff, customers or agents should treat it as live.

Finance teams already use AI, often through personal accounts. A short policy built on COSO, NIST and ISO/IEC 42001 tells people what is allowed, who owns each use and what evidence to keep.

A nonprofit that spends $1 million or more in federal awards in a year needs a single audit. This checklist covers what auditors test, where findings come from, and what OMB's proposed rewrite does and does not change.

US disclosure mandates on private companies narrowed in 2025 and 2026, but lenders, customers, funders and buyers still ask the same questions. What to publish, in three tiers, and how to keep it credible.

Ten rules-based tests on ledger, payment, vendor, payroll and access data, each with its logic, frequency and the named reviewer who clears the exceptions. Start with three, tune them, then add the rest.

Fraudsters rarely break into the bank. They ask accounts payable to update a vendor's bank details. Five controls, run in a fixed order, make that request fail.

Fake receipts made with AI image tools are now a reported pattern in expense fraud. How to move evidence to the card, which checks still work, and the policy clauses to add.

Three people can cover the duties that matter if every payment, change and entry needs two of them, and if the bank and the ERP enforce the split instead of goodwill.

COSO's 17 principles turned into checks a growing company can answer with a document or a report, plus what lenders, buyers and auditors still test when no auditor attestation is required.

A first fraud risk assessment needs five or six of the right people, five system reports and four disciplined hours. Here is the agenda, and the register to fill in by the end of the day.

A speak-up channel works when reports reach someone independent of the people named, get triaged within days and never cost the reporter. Under the DOJ pilot, a company's 120-day clock starts with the internal report.

Most codes are written to be signed, not used. Rebuild yours around the decisions employees face, with plain questions, real limits and a named person to ask, and test whether people can find answers in it.

A quarterly question set for private-company and nonprofit boards, covering close quality, cash controls, the hotline, related parties and AI use, with good and worrying answers side by side.

A related-party policy that works: who counts, how approval runs, what ASC 850, Form 990 Schedule L and credit agreements each require, and an annual workflow to keep the log complete.

A modular table of contents for a finance manual, with one line per section on what it must say, and the habits that keep it searchable, owned and current.