Two Approvals Are Not Independent If Both People Trust the Same Email

A payment request has two approvals, so the process looks controlled. But both approvers read the same email, accept the same changed bank details, and assume the other person checked the supplier. The organization has counted two clicks while obtaining only one source of evidence.

The value of a second person is not their presence alone. It is the distinct check they perform and their ability to stop the action. If the second reviewer only confirms that the first reviewer approved, the process can reproduce an error instead of challenging it.

Separation of duties is about capability, not ceremony

NIST’s separation-of-duty definition describes dividing privileges so that one user cannot misuse a system alone; it includes the two-person rule as an example. That principle is broader than adding a second signature to a form. It concerns which actions each role can perform.

For a payment workflow, distinguish creating or changing a payee, preparing a transaction, verifying the business instruction, and authorizing release. The right division depends on the organization and system. A tiny business cannot always assign four separate employees, but it can still identify which incompatible actions should not be silently combined.

This article proposes a practical review model. It does not claim that a particular arrangement satisfies every financial, regulatory, or contractual requirement. Consult the relevant internal owners and bank capabilities when implementing controls that affect real payments.

The same-source problem

Consider a fictional supplier invoice with a request to use new bank details. The preparer enters the details from the email. The approver compares the entered details with the attached invoice and approves. Both checks are accurate at the level of transcription. Neither establishes that the supplier authorized the new destination.

A third person could repeat the comparison and still add no independent verification. The missing evidence is not another view of the same document; it is confirmation through a trusted route that is separate from the request introducing the change.

The FBI’s BEC guidance recommends verifying payment requests and changes through independent contact, including a known phone route rather than one supplied by a potential scammer. Our article on invoice bank-detail changes explains the scenario. Here the focus is how to assign that check so it actually happens.

Give each review a distinct job

These stages may be combined in some systems, but the questions should remain visible. An approval screen that shows only an amount and a familiar supplier name may not give the reviewer enough information to identify a changed destination.

Make the change visible

A recurring supplier can create a false sense of continuity. The business relationship is familiar, so the reviewer may focus on whether the amount looks normal. The interface should make a new or changed payee destination visible rather than burying it in a field that looks identical to last month’s payment.

Where supported, separate payee maintenance from payment release and restrict who can perform each action. Keep a record of what changed, who requested it, and who verified it. Do not let a change to a contact phone number automatically become the evidence used to verify a bank-detail change in the same request.

A record is useful only if the reviewer can access and understand it. Avoid requiring them to search several inboxes or rely on an oral assurance that the check happened. A short structured note can identify the route, the confirming role, the date, and the result without collecting unnecessary sensitive information.

The second person needs permission to disagree

If the organization treats a hold as obstructive, the second approval becomes social theater. The reviewer may have the technical ability to reject but feel unable to use it, especially when a senior person frames the payment as urgent or confidential.

Define the conditions that require a hold and the route for resolving it. A reviewer should be able to say that a destination change lacks independent confirmation without accusing the requester of fraud. The business can then obtain the missing evidence or use a documented exception process.

Our analysis of authority pressure and exceptions covers this organizational tension. A leader’s request can establish urgency or business priority. It should not silently replace the verification that the organization requires for everyone else.

Urgency needs a staffed route

Some payments genuinely cannot wait for the ordinary queue. Plan for that case instead of letting each emergency invent its own control. Name a backup verifier and approver, specify what evidence remains mandatory, and record who accepts any residual risk within their authority.

Do not make the exception route easier than the normal route in a way that rewards callers for claiming an emergency. It should be faster to reach an authorized decision maker, not easier to skip identity, destination, or business-purpose checks.

Afterward, review the exception. Was the urgency real? Could the normal workflow have handled it with better planning? Did the same exception recur? A pattern of urgent overrides may indicate that the process is badly designed or that its limits are being tested.

Small teams can still create independence

A two-person business may not have a separate finance department. It can still distinguish preparing a payment from verifying a new destination, use bank-provided approval features where suitable, and maintain trusted supplier contact information. The second person should inspect the specific change rather than simply approve a total.

If only one authorized person is available, the organization should acknowledge that limitation. An after-the-fact review is not the same as preventive dual approval. A delay, a lower-risk alternative, or a formally accepted exception may be appropriate depending on the circumstances. Do not describe a single-person process as independent merely because it produces two records.

Outside bookkeeping or banking support may help some businesses, but access and responsibilities need clear agreement. Adding an external reviewer without defining their evidence and authority can create another handoff without improving the decision.

Test the control with a harmless example

Use a dummy payment record and a fictional destination change in an announced exercise. Ask the preparer and approver to follow the documented process without moving real money. Observe which source each person uses, what they record, and when they would stop.

Then change one condition: the usual supplier contact is unavailable, the request arrives near a deadline, or the first reviewer has already approved. Does the second person still know what evidence is missing? The purpose is to test independence under ordinary pressure, not to catch employees with a surprise deception.

Document whether the system prevents one person from performing incompatible actions where that is required. A written policy can be undermined by permissions that allow an easy bypass. Conversely, a technical restriction can still fail operationally if people share accounts or treat approval as a favor.

Review the reviewer handoff

In the dummy exercise, ask each person to describe what they believe the other person has checked. Write the answers separately before comparing them. The preparer may believe the approver verified the supplier, while the approver believes the preparer already did. That mismatch is a concrete workflow defect, even if every participant followed their own understanding of the process.

Repair the handoff with an explicit status, not a vague label such as “checked.” For example, distinguish “invoice matched to purchase record” from “changed destination independently confirmed.” A reviewer should see which condition is complete, which is unresolved, and who owns the next decision. Avoid including full account numbers in a broadly visible notification merely to make the status look detailed.

Test delegation as well. When the usual approver is absent, the replacement needs the same relevant information and stopping authority. They should not inherit a queue of apparently pre-approved payments without knowing which checks remain outstanding. Documenting a substitute role is more useful than relying on a colleague’s memory of how the process usually works.

If a suspicious transfer is already released

Use the incident process and contact the originating financial institution promptly through its official route. The IC3 BEC guidance describes seeking recall or reversal and filing a detailed report. Recovery is not guaranteed. Preserve the transaction identifiers and approval history so responders can understand what occurred.

Do not erase the original request or alter records to make the process look compliant. Separate confirmed facts from assumptions about who controlled an account. A failed control is important evidence for improvement, and accurate records are more useful than a reconstructed story designed to assign blame.

What a meaningful approval should leave behind

The final record should let another authorized reviewer understand the business purpose, the destination check, the transaction, and any exception without interviewing everyone involved. It should show who performed each decision and which evidence they used. Keep the record proportionate and protected.

Two approvals are valuable when they represent two accountable roles and a genuine independent check. They are less valuable when they merely repeat the same assumption. The practical test is simple: if the original email were wrong, what in the process would discover that before the payment leaves?