Small cracks in financial controls rarely command much attention. Access reviews, approval paths, and separation of duties can feel like routine work for IT and Finance. Yet these processes sit close to the weaknesses that enable many cyber incidents. When they fail, control violations can provide an early view of where safeguards are beginning to erode.
APQC's latest global benchmarking data puts the issue in perspective. The median organization reports about six control violations for every 1,000 business entity employees. At the 75th percentile, the figure rises to nearly 14 on average. The volume may appear modest, but every violation marks a point where a process did not work as intended. Viewed together, those points can reveal a pattern of changing exposure.
How Can Control Violations Reveal Cyber Risk?
Research on cybersecurity and enterprise risk management (ERM), based on data from 5,000 organizations globally, reinforces the value of these early clues. Organizations with stronger integration maturity use ERM routines and dashboards to improve visibility into everyday processes and controls, helping leaders identify weak points before they widen.
The opportunity remains significant. A little less than half of organizations have integrated ERM with business functions to manage risk, while about 40% report some level of integration between cybersecurity and ERM. Control violations add useful context by showing where responsibilities may be unclear, access may be drifting, or business processes may be changing faster than their safeguards.
Why Should Finance Connect Control Violations to ERM?
Finance leaders are well positioned to bring these observations into ERM discussions. A rise in violations, or a cluster within one process, can prompt sharper questions: Are duties concentrated in ways that create vulnerability? Are approval paths still appropriate? Have access rights expanded beyond what employees need?
For a closer look at the benchmarking measure and its implications, explore APQC's Metric of the Month. The metric alone cannot explain why a control failed, but it can direct attention to the places most deserving of review.
What Actions Should Finance Leaders Take?
Start by identifying where violations cluster and whether the same failures recur. Bring those patterns into risk assessments so Finance, IT, compliance, and business owners can clarify accountability. Then strengthen the routines behind reliable controls through clearer approvals, more frequent access reviews, and updated process steps.
Cybersecurity is often framed as a technical challenge, but much of an organization's exposure is created in daily work. Treating control-violation trends as part of a broader risk story helps leaders recognize small breakdowns for what they may be: early warnings. Acting on them sooner can strengthen both financial governance and cyber readiness before a minor lapse becomes a costly incident.