Practical guidance on internal controls, fraud, governance, AI in finance and financial transparency, with dated sources.https://financeethics.com/en-ushttps://financeethics.com/insights/supplier-carbon-data-requests-sb-253-csrd/https://financeethics.com/insights/supplier-carbon-data-requests-sb-253-csrd/Large customers are collecting emissions data for California's SB 253 and the EU's CSRD. What they may ask, what they will ask next, and how a supplier can answer once and reuse it.Tue, 03 Nov 2026 00:00:00 GMTTransparencyhttps://financeethics.com/insights/doj-corporate-enforcement-policy-2026/https://financeethics.com/insights/doj-corporate-enforcement-policy-2026/Since 10 March 2026, one DOJ policy governs corporate self-disclosure in every criminal matter except antitrust. Its rewards go to companies that find problems first and report promptly, which takes capability built in advance.Tue, 03 Nov 2026 00:00:00 GMTRegulationhttps://financeethics.com/insights/beneficial-ownership-after-cta-rollback/https://financeethics.com/insights/beneficial-ownership-after-cta-rollback/FinCEN's final rule ended beneficial ownership reporting for US companies and US persons. Foreign reporting companies still file, banks still ask, New York has its own law, and buyers still want the chart.Tue, 03 Nov 2026 00:00:00 GMTRegulationhttps://financeethics.com/insights/controls-before-ai-agents-run-the-close/https://financeethics.com/insights/controls-before-ai-agents-run-the-close/An AI agent that can post, reconcile or route invoices is a system user. Give it its own identity, keep it inside your segregation of duties rules, cap what it can do alone and keep evidence an auditor can replay.Tue, 03 Nov 2026 00:00:00 GMTAI in financehttps://financeethics.com/insights/deepfake-cfo-scam-payment-verification-protocol/https://financeethics.com/insights/deepfake-cfo-scam-payment-verification-protocol/The 2024 Arup loss happened without a single system being breached. The defense is a written rule that no voice, face or message authorizes a payment on its own, backed by callbacks and dual release.Tue, 03 Nov 2026 00:00:00 GMTFraudhttps://financeethics.com/insights/failure-to-prevent-fraud-us-companies/https://financeethics.com/insights/failure-to-prevent-fraud-us-companies/The UK offence counts your whole group toward its size test and turns on where the fraud touches the UK, not where you are incorporated. A US group with UK staff, customers or agents should treat it as live.Tue, 03 Nov 2026 00:00:00 GMTRegulationhttps://financeethics.com/insights/ai-governance-policy-finance-teams/https://financeethics.com/insights/ai-governance-policy-finance-teams/Finance teams already use AI, often through personal accounts. A short policy built on COSO, NIST and ISO/IEC 42001 tells people what is allowed, who owns each use and what evidence to keep.Tue, 03 Nov 2026 00:00:00 GMTAI in financehttps://financeethics.com/insights/single-audit-readiness-checklist/https://financeethics.com/insights/single-audit-readiness-checklist/A nonprofit that spends $1 million or more in federal awards in a year needs a single audit. This checklist covers what auditors test, where findings come from, and what OMB's proposed rewrite does and does not change.Tue, 03 Nov 2026 00:00:00 GMTNonprofitshttps://financeethics.com/insights/voluntary-financial-transparency-private-companies/https://financeethics.com/insights/voluntary-financial-transparency-private-companies/US disclosure mandates on private companies narrowed in 2025 and 2026, but lenders, customers, funders and buyers still ask the same questions. What to publish, in three tiers, and how to keep it credible.Tue, 03 Nov 2026 00:00:00 GMTTransparencyhttps://financeethics.com/insights/continuous-controls-monitoring-tests/https://financeethics.com/insights/continuous-controls-monitoring-tests/Ten rules-based tests on ledger, payment, vendor, payroll and access data, each with its logic, frequency and the named reviewer who clears the exceptions. Start with three, tune them, then add the rest.Tue, 03 Nov 2026 00:00:00 GMTControlshttps://financeethics.com/insights/vendor-bank-change-fraud-controls/https://financeethics.com/insights/vendor-bank-change-fraud-controls/Fraudsters rarely break into the bank. They ask accounts payable to update a vendor's bank details. Five controls, run in a fixed order, make that request fail.Tue, 03 Nov 2026 00:00:00 GMTFraudhttps://financeethics.com/insights/expense-policy-ai-generated-receipts/https://financeethics.com/insights/expense-policy-ai-generated-receipts/Fake receipts made with AI image tools are now a reported pattern in expense fraud. How to move evidence to the card, which checks still work, and the policy clauses to add.Tue, 03 Nov 2026 00:00:00 GMTFraudhttps://financeethics.com/insights/segregation-of-duties-three-person-finance-team/https://financeethics.com/insights/segregation-of-duties-three-person-finance-team/Three people can cover the duties that matter if every payment, change and entry needs two of them, and if the bank and the ERP enforce the split instead of goodwill.Tue, 03 Nov 2026 00:00:00 GMTControlshttps://financeethics.com/insights/internal-controls-checklist-growing-companies/https://financeethics.com/insights/internal-controls-checklist-growing-companies/COSO's 17 principles turned into checks a growing company can answer with a document or a report, plus what lenders, buyers and auditors still test when no auditor attestation is required.Tue, 03 Nov 2026 00:00:00 GMTControlshttps://financeethics.com/insights/fraud-risk-assessment-in-one-afternoon/https://financeethics.com/insights/fraud-risk-assessment-in-one-afternoon/A first fraud risk assessment needs five or six of the right people, five system reports and four disciplined hours. Here is the agenda, and the register to fill in by the end of the day.Tue, 03 Nov 2026 00:00:00 GMTFraudhttps://financeethics.com/insights/whistleblower-hotline-setup-small-companies/https://financeethics.com/insights/whistleblower-hotline-setup-small-companies/A speak-up channel works when reports reach someone independent of the people named, get triaged within days and never cost the reporter. Under the DOJ pilot, a company's 120-day clock starts with the internal report.Tue, 03 Nov 2026 00:00:00 GMTEthics and governancehttps://financeethics.com/insights/code-of-ethics-employees-actually-read/https://financeethics.com/insights/code-of-ethics-employees-actually-read/Most codes are written to be signed, not used. Rebuild yours around the decisions employees face, with plain questions, real limits and a named person to ask, and test whether people can find answers in it.Tue, 03 Nov 2026 00:00:00 GMTEthics and governancehttps://financeethics.com/insights/board-questions-for-the-cfo/https://financeethics.com/insights/board-questions-for-the-cfo/A quarterly question set for private-company and nonprofit boards, covering close quality, cash controls, the hotline, related parties and AI use, with good and worrying answers side by side.Tue, 03 Nov 2026 00:00:00 GMTEthics and governancehttps://financeethics.com/insights/related-party-transactions-policy/https://financeethics.com/insights/related-party-transactions-policy/A related-party policy that works: who counts, how approval runs, what ASC 850, Form 990 Schedule L and credit agreements each require, and an annual workflow to keep the log complete.Tue, 03 Nov 2026 00:00:00 GMTEthics and governancehttps://financeethics.com/insights/financial-policies-procedures-manual-contents/https://financeethics.com/insights/financial-policies-procedures-manual-contents/A modular table of contents for a finance manual, with one line per section on what it must say, and the habits that keep it searchable, owned and current.Tue, 03 Nov 2026 00:00:00 GMTControls