The funding handoff should carry the verification record.

The instruction changes. The caller is in a hurry. The person who usually handles funding is out. This is where a written procedure either becomes an operating routine or becomes a document nobody can find.

The question for an operating review is not whether the office has a wire-fraud policy. It is whether the next person in the handoff can see what happened.

Trace the record, not the recollection.

Start with a scoped sample and ask the staff to show the record of verification and approval. Identify who received the instruction, who verified it, who had authority to approve it, and where the supporting evidence lives.

When the explanation starts with “we always call,” ask where the call is documented. When it starts with “she knows that customer,” ask what the backup person sees. The point is to understand whether the control belongs to the office or to one person’s memory.

Separate a change from a routine instruction.

Make changed instructions identifiable in the operating queue. A change can require a different review path under the company’s procedures. If it looks exactly like routine work, staff have to remember the context every time the item changes hands.

The FBI describes business email compromise scenarios involving real-estate wire instructions. Its guidance includes independently checking the contact number and verifying payment requests or changes. That is a source reference for the risk; the company’s bank, counsel, and security advisers should inform the specific control design.

Make the handoff answer four questions.

• What instruction or change is being acted on?
• Where is the supporting verification record?
• Who has reviewed it, and who can authorize the next step?
• What happens if the information conflicts or an expected reviewer is unavailable?

A queue entry should point to the authorized records rather than reproducing account details in another loosely controlled system. Permission design matters as much as the label on the queue.

Test the absence scenario.

Walk through the process with the usual funding person absent. Ask a designated backup to locate the procedure, the record, the approval path, and the escalation contact. Do this as a controlled review, not as an experiment with a live transfer.

Record the points where access, ownership, or instructions are unclear. Those are concrete operating gaps. They can be assigned and reviewed. “Be more careful” cannot.

Technology keeps the evidence visible.

An internal tool can organize the queue, capture review status, and expose exceptions. It does not replace approval authority. MWM’s AI-assisted work keeps people in the loop: nothing releases funds or sends documents without staff approval.

Source notes

FBI: Business email compromise

An operating perspective, not a legal, regulatory, accounting, or security opinion. Requirements and controls depend on the business and its professional advisers.