[Compliance] What do you do if you inherit an HR process that is common practice but poorly controlled?

I would not assume it is fine just because it has been done that way for a long time. Common practice can hide weak controls really well, especially if nobody has had to rely on the process under pressure yet.

So I would first understand how the process currently works in reality, where the decision...