You are building a risk register for an agent that handles accounts-payable exceptions. Four candidate risks have been identified. Which should be ranked highest for control investment?

Answer: C — Rarely, a changed bank-account number in an invoice is accepted and the payment goes out automatically to that account

Ranking should weigh impact, reversibility and blast radius, not just frequency. A payment sent to a fraudulent account is high-impact and often irreversible, so it warrants prevention (verified account changes), detection and containment (holds or approval gates) despite being rare. (a), (b) and (d) are frequent but cheap, and a human corrects them before any harm.