# Review a conflict-of-interest disclosure

> Carry a concern about Acme's supplier through restricted investigation, independent decision and corrective work.

_Updated: 2026-10-07_

## Continue the Acme case

Tom reports that a relative works at **Aster Equipment**, after Acme's $6,000 purchase. This fictional new fact explains why the same transaction needs a compliance review even though [Accounting's close](/en/learn/accounting-close) balanced. A disclosure is not proof of misconduct, and a detector signal is not a finding.

## Role and prerequisites

Tom uses the available company disclosure process in Core and sees only his own submission. The compliance expert handles triage and evidence; Head of Compliance and any assigned authority make the required decisions. Access is restricted to the case's permitted participants. Acme's applicable conflict policy supplies the review criterion.

## Investigate the facts

1. Submit the relationship, relevant dates, supplier and purchase reference with permitted supporting documents. Confirm the current company and trusted submitter identity.
2. As the assigned compliance expert, record scope and applicable policy version. Establish what was known when supplier selection and approval occurred; do not alter those historical dates.
3. Gather allowed evidence: quotation, supplier review, decision history and Tom's explanation. Separate confirmed facts, missing facts and allegations. Request information through assigned work instead of exposing the whole case to every employee.
4. Prepare the reasoned conclusion and proposed measures. In this training case, propose recusal from future Aster decisions and an independent review of the original selection. The authorised reviewer decides; Tom cannot close his own case.
5. Assign corrective work with owner, deadline and evidence criterion. Reopen the submission under Tom's identity to verify the permitted status and follow-up response path.

## Verify the saved result

The reviewed case retains the disclosure, policy version, evidence, decisions and assigned measures. An action owner's reply is not independently verified closure. If the original accounting result needs correction, use its supported controlled route rather than editing it inside GRC.

Continue to [a risk-control matrix](/en/learn/grc-control-matrix). The overdue disclosure becomes a concrete control question; neither fraud nor a financial loss is presumed.