The client operates, founds, and runs various niche online shops in Switzerland, Germany, Austria, and Sweden, increasing complexity. Currently, there is no clear structure in the approval process, leaving the process highly effort and time-consuming. This thesis aims to develop an improved, time-efficient, straightforward approval process while improving control.

The theoretical framework focuses on ICS, fraud prevention, risk assessment, and ERP systems. Those areas help to understand the basis and guide the analysis of the process. Interviews were conducted with relevant personnel to gather insight into the current approval process. Based on those interviews, the approval process can be described. This process was subject to a risk assessment. This includes the identification of risks and their quantitative risk analysis as well as the plan risk response of those risks.

The four risks identified were incorrect invoices, incorrect allocation of invoices, high involvement of the CEO, and separate systems. The quantitative risk analysis shows that the high involvement of the CEO and the separated systems have both a likelihood that is certain. The separated systems have a major, and the high involvement of the CEO has a moderate impact on the business. Those two measures classify those two risks as high risks. The incorrect allocations of invoices are very likely to happen, while incorrect invoices have a possible likelihood. Both risks have a moderate impact on the business, leaving them as moderate risks. The next step in the risk assessment is the plan risk response. The plan risk response found that the incorrect invoices could be minimized by using a three-way match. The incorrect allocation of costs could be solved by a system that automatically recognizes cost units, cost centres, and approvers. The third risk is the high involvement of the CEO, which could be solved by taking away small invoices from the CEO. The fourth risk is that introducing a coherent ERP system could solve the separated systems.