A risk alert is not a conclusion. It may come from a cross-comparison of filing data, or be triggered by a related party upstream or downstream. Once it arrives, the easiest mistakes are: explaining in a hurry, answering from memory, or ignoring it altogether.

Step one: locate the source

First establish which segment the alert points to — revenue recognition conventions, cost structure, how invoices were obtained, or the path of funds between accounts. Each source calls for a completely different response, and answering in the wrong direction only narrows your options later.

Step two: verify the facts

• Pull the data for the period in question and reconcile it against the ledgers, the filed returns and the bank statements;
• Confirm whether the transactions are real, the documents complete and the conventions consistent;
• Turn the possible explanations and their evidence into a checklist rather than a pile of arguments.

Step three: decide the approach, then communicate

Only once the facts are clear do you decide: if it is a difference in interpreting a rule, prepare an explanatory file; if it is a legacy issue, set out a remediation schedule alongside; if there genuinely is a problem, work out the correction path first. The value of communication lies in clarity, not volume.

How we typically handle it

In our structured risk scan, this becomes a sequence: establish the facts, prepare the documents, then align on how to communicate. For companies that have completed a full scan, the remediation checklist in the 40-60 page report is itself the working paper for responding.

Applicability and final determinations rest with the competent authorities. What we can guarantee is that a company is never left to commit itself to a position without understanding the situation.