Why one person should never move the company's money

One person should not be able to move the company's money alone.

It is an old rule, it is not clever, and almost every organisation that has one has spent years slowly weakening it — not by decision, but by a series of individually reasonable conveniences.

What the rule is actually protecting against#

Not primarily theft. Theft is the case everybody cites and the least common one.

The rule protects against three things, and the first two are much more likely than the third.

Error. Wrong vendor selected from a list, wrong amount typed, wrong invoice attached, payment made twice. A second person looking at the same payment catches a meaningful proportion of these, because they are reading it fresh rather than checking their own work.

Pressure. A person being leaned on — by a vendor, by a senior colleague, by circumstances — is much harder to lean on when the payment requires somebody else too. The rule does not just detect wrongdoing; it gives an honest person a reason they can say out loud.

Deliberate misuse. Rarer, and the reason the rule is written down.

The first two are why the rule earns its keep on a normal day, and it is worth saying so, because a control justified only by suspicion is a control people resent.

The conveniences that dissolve it#

None of these is proposed in bad faith. Each is proposed by somebody trying to make a real problem go away.

Amount bands. "Payments below a certain figure only need one signature." This is the most common and the most damaging, because it does not weaken the rule — it repeals it. There is now a size of payment one person can make alone, and a person intending misuse will simply make several. When this was proposed in our own system, we built everything else in that release and left this half out, on the grounds that a floor with a hole in it is not a floor.

Standing approvals. "This vendor is approved, so payments to them do not need a second look." The second signature is not about the vendor's legitimacy. It is about this payment.

Emergency overrides. Necessary, and the correct design is not to remove them but to make them loud: a named person, a stated reason, recorded distinctly, and visible afterwards without anybody having to go looking. An override that is quiet becomes an ordinary route within a month.

Delegation done carelessly. Somebody is travelling and hands their authority to a colleague — who already holds the other signature. Two slots, one human, and the rule is gone while the screen still shows two names.

Each of the four is a question worth putting to a vendor before you buy — approval chains worth asking about.

Delegation without collapsing the floor#

Delegation is genuinely necessary. People travel, take leave, fall ill, and a payment system that stops when one person is unavailable will be routed around.

The version that works has four properties:

• Bounded in time. A window with an end date, not an open-ended transfer.
• Revocable by either party, immediately.
• Never to somebody who already holds the other slot. One human must not end up holding two signatures, and this has to be enforced by the system rather than by the good sense of whoever sets it up.
• Visible on the record. The audit says on behalf of, and the person being stood in for is told when it is arranged.

The emergency override, if you have one, stays with the original holder. A stand-in gets the ordinary authority, not the exceptional one.

That is how we built it, and the constraint that shaped every part of it was the same sentence: two different humans sign every payment, and the floor never moves.

The second signature has to be a real reading#

A control that everybody performs and nobody exercises is worse than no control, because it produces a record of scrutiny that did not happen.

The second signature stops being real when the queue is full of items that require no thought. Approve forty routine payments and the forty-first gets the same reflex. This is not a character flaw; it is what attention does.

So the design job is to keep the queue about decisions. Three things help:

Only ask about money that has not yet moved. A queue that includes payments already made is asking for a decision that cannot be made — the money is gone — and it teaches people the queue is decorative. We had exactly this fault: a fix in one place caused every already-paid item to appear in the approvals queue asking to be signed, some of them weeks old. Money that moved without a sign-off has not been forgotten, but it belongs in its own place, where the question is who authorised this rather than shall we.

Put the facts that decide it on the row. Whether material has arrived against this payment, whether it is an advance, what the order was for. Our approvals queue says either that delivery documents have been filed or, in amber, that none have — money before material? A question, not a block, since some payments rightly precede material.

Say what is unusual. A signer's attention should be spent on the exceptional row, which means the system has to know which row is exceptional and say so. The general form of that argument is in an alert that rings for everything.

The record is half the control#

A signature that leaves no durable trace protects nobody, including the person who gave it.

What has to survive: who signed, when, on what basis, on which version of the document, and — where a delegation was used — for whom. That record must be one that cannot be quietly revised afterwards, which is the whole subject of what an audit trail is for.

And the record should protect the approver as much as the company. A person who signed something correctly, on the information available at the time, should be able to demonstrate that years later. That is not a side benefit. It is a large part of why people are willing to sign at all.

The short version#

Two different people on every payment, with no amount below which the rule lapses.

Delegate in bounded, revocable windows that can never put both signatures in one pair of hands. Make overrides loud rather than removing them. Keep the queue about money that has not yet moved, so the second reading stays a real one.

Every erosion of this arrives as a convenience, and each one is reasonable on its own. That is precisely why the floor has to be stated as a floor.