Who should own business email compromise training and verification processes across departments?

Who Owns BEC Training and Verification Across the Business?

Ownership should sit where the risk actually lands: security owns the control design, finance owns payment verification, and business leaders own the day-to-day enforcement in the teams that approve invoices, vendor changes, and bank detail updates. That split keeps BEC from becoming “someone else’s problem” and makes the workflow executable in real operations.

The key question is not which team writes the policy, but who can stop a fraudulent payment, challenge a suspicious request, and correct a broken handoff. If those decisions are spread across departments without a named owner, the training will be inconsistent and the verification step will fail at the exact moment pressure is highest.

In practice, the best ownership model is a control owner for the standard, a process owner for each department, and a single escalation path for exceptions. That structure works because BEC exploits gaps between teams, not just gaps in awareness.

How Shared Ownership Should Work in Practice

Security should define the minimum verification standard, the required evidence for approval, and the red flags that trigger a pause. Finance should control the payment-specific checks, including call-back rules, bank-account change validation, and dual approval where value or risk justifies it. Business units should own the local workflow because they understand who is allowed to request changes and how urgent requests normally move.

This is why Email Identity and BEC Guide is useful here, since payment verification works best when email authentication, mailbox abuse controls, and human verification steps are treated as one process rather than separate problems. The same is true of OWASP ASVS, which reinforces that authentication and authorisation checks are only effective when the process around them is consistently enforced.

For larger organisations, the process owner should also define what is mandatory versus what is discretionary. If a business unit can override verification informally, the control exists on paper but not in practice.

What Good Governance Looks Like When BEC Is Cross-Functional

Good ownership is visible in the operating model. Teams know who approves vendor-bank changes, who verifies out-of-band requests, who trains new joiners, and who reviews exceptions after the fact. The workflow should be simple enough that staff can follow it under time pressure, but strict enough that a single email thread cannot bypass it.

That means using one standard set of verification questions, one documented approval path, and one requirement to escalate anything unusual. It also means training should be role-specific: finance needs payment-fraud scenarios, procurement needs vendor-change scenarios, and business managers need to understand when to slow a request down rather than “help it through.”

Independent guidance and operational practice matter here too. SANS Security Resources is useful for building incident-handling habits around suspicious requests, while Arup deepfake fraud 2024 is a reminder that BEC is not limited to email text alone. Verification processes need to assume that messages, calls, and even video can be manipulated.

Risk and Threat Considerations

business email compromise works because it targets process ownership gaps. If no department is clearly accountable for verification, attackers can exploit urgency, hierarchy, and routine payment handling to push a fraudulent request through before anyone pauses to confirm it.

Failure mechanism: The control fails when the request is treated as a communication task instead of a business approval decision, allowing one team to assume another team has already verified it.

Impact: The result can be unauthorised payments, vendor diversion, account change fraud, and a repeatable attack path that keeps working until someone formally owns the process.

Practitioner Guidance

What to prioritise: Assign a named business owner for each high-risk workflow, especially invoice approval, bank detail changes, and urgent payment exceptions. Security should define the standard, but finance or the relevant business function must own enforcement where the transaction happens.

What to verify: Confirm that every department uses the same verification script, the same escalation route, and the same exception record. If teams are improvising their own checks, you do not have one control, you have several uncontrolled variants.

Common mistake: Treating training as the solution and ownership as an administrative detail. BEC resilience usually breaks at the handoff between teams, so the owner must be the person or function that can actually stop the transaction.

Practitioner takeaway: The right model is shared accountability with local enforcement, because BEC only becomes controllable when the people who approve money, vendor changes, and exceptions are the same people accountable for the verification step.

Related resources from NHI Mgmt Group

• How should security teams make NHI best practices usable across the business?
• How should universities reduce business email compromise risk across mixed identity populations?
• How should organisations reduce business email compromise risk without relying only on awareness training?
• Who should own business email compromise defence in the enterprise?