The risk profile is changing shape
Risk in technology and telecom businesses used to be thought of mainly in terms of network outages and regulatory penalties. Those remain important, but the profile has broadened. Companies in Bangladesh now process large volumes of digital payments, hold extensive customer data, rely on outside vendors for core operations, and sell through large networks of distributors, retailers and agents. Each of these brings risks that traditional controls were not designed to cover.
Foreign currency is a further pressure. Network equipment, software licences and many vendor contracts are priced in foreign currency while revenue is earned in taka, so exchange rate movements and the availability of foreign exchange for payments feed directly into both cost and operational risk.
Revenue leakage and channel fraud
Leakage arises when services are delivered but not billed, billed at the wrong rate, or billed but not collected. Common sources include interconnect and roaming settlements, misconfigured tariff plans, unbilled enterprise services and gaps between network usage records and billing systems. Regular, independent reconciliation across these points is the most reliable defence.
Distribution channels carry their own risks: commission schemes that reward volume over genuine activity, misuse of subscriber registration, and abuse of recharge or agent float. Where these concerns become specific, our Forensic Services investigate suspected fraud and misconduct, preserve evidence properly and help management respond in a way that will stand up to regulatory or legal scrutiny.
Cyber, data and third-party exposure
Ransomware, account takeover, SIM swap fraud and data breaches are now standing risks for operators, fintechs and software firms, and a single incident can bring regulatory attention, customer losses and lasting reputational damage at once. The control gaps we see most often involve privileged access, weak monitoring of administrator activity, slow patching and limited testing of incident response. Vendors with remote access to networks or customer systems widen the exposure further.
Our IT Advisory team assesses these areas through IT audit, cybersecurity reviews and technology risk assessments, and helps prioritise remediation by business impact rather than technical severity alone.
Where independent review helps
Many controls in the sector are automated, which means that a single configuration error can affect thousands of transactions before anyone notices. Periodic independent review gives management and audit committees assurance that controls are working as designed, not only that they exist on paper.
Our Risk Consulting team delivers risk-based internal audit for boards and audit committees, either as a full outsourced function or in support of an in-house team. Coverage typically includes revenue assurance, procurement, vendor management, regulatory compliance and the governance of significant change programmes, with findings reported in a form directors can act on.
Related RRH services: Forensic Services, IT Advisory and Risk Consulting.