Security Guides

Why two people should approve a payment

Estimated Reading Time =

2 minutes

Technical Level =

Intermediate

Threat Level =

Medium

Attack Type =

Other

Editorial illustration for why two people should approve a payment

What you will learn

What you will learn

A second approval helps only when it independently checks the important details. Tie the review to the actual beneficiary, amount, and transaction that will be released.

Two approvals can reduce payment mistakes and fraud, but only if both people check the final transaction. One person approving an invoice and another approving a general budget is not necessarily a check of the actual destination. The process should make the important details visible to both.

Understand the idea

Agree which payments need a second reviewer and what that reviewer verifies. Include the beneficiary, account details, amount, and business reason. A change after approval may need renewed approval. The bank or payment system should enforce the chosen rule where suitable, rather than relying only on a promise.

A simple way to follow the process
  1. Prepare

    Match the payment to the approved business purpose.

  2. Review

    Have a second authorized person verify the final details.

  3. Release

    Prevent unchecked changes between approval and execution.

A practical example

For example, a supplier changes bank details after an invoice has been approved. The finance officer verifies the change independently, and the second approver reviews the exact destination before release. The earlier invoice approval does not silently cover a different account.

Visual guide: Why two people should approve a payment
Match the payment to the approved business purpose. Have a second authorized person verify the final details. Prevent unchecked changes between approval and execution.

What to do next

  1. Confirm the underlying purchase or obligation from trusted records.
  2. Compare the beneficiary with the approved supplier record.
  3. Independently verify changed payment instructions using a previously established contact route.
  4. Inspect the actual payment being released, including amount and destination.
  5. Record the approvers, evidence, and time in the controlled payment system.

How to check the result

Use a harmless test to check whether an unapproved change can bypass the rule. Keep the confirmation and final approval with the payment record.

The invoice was approved, but the account number changed afterward.

The payment needs a renewed check of the changed destination. Approval of an earlier version should not silently authorize different payment instructions.

Sources and useful guides

The following resources provide background and more detailed guidance. Use the sections that match your service and situation.

Scroll to Top