Duties to split
What one person should not do alone.
Some work should need two people: adding a supplier and paying it, giving someone admin access and approving it, changing a record after it is signed off. The audit finds where one person can do it alone. The build adds a blocker, and the action waits until a second, named person approves it.
What the audit asks
The audit's own questions on duties to split, and the blocker each answer becomes. A business is asked the ones that apply to it.
Can the same person add a supplier, change its bank details and pay it?
Asked of every business
SeriousOne person can add a supplier, change its bank account and pay it.
The blockerA new supplier or a bank-detail change needs a second person's approval, and no payment goes to new details until they are confirmed.
When a supplier emails new bank details, is the change confirmed by phone on a number you already had?
Asked of every business
SeriousBank-detail changes sent by email are not confirmed by phone.
The blockerA bank-detail change is held until someone records the call-back on a number already on file.
Can anyone approve their own expenses, overtime or pay changes?
Asked of every business
MediumPeople can approve their own expenses, overtime or pay changes.
The blockerNobody approves their own claim; it goes to their manager, and a manager's to a second person.
Does the person who raises invoices also record the payments and the credit notes?
Asked of every business
MediumThe same person raises invoices and records payments and credit notes.
The blockerCredit notes and write-offs need a second person; payments are matched from the bank feed.
Can a record be changed after it is signed off (a check, a delivery, an invoice) without leaving a trace?
Asked of every business
SeriousSigned-off records can be changed without a trace.
The blockerSigned-off records lock. A change is a new entry with a name and a reason, and the original is kept.
Can anyone give themselves more access in a system?
Asked of every business
MediumPeople can give themselves more access.
The blockerAn access change needs an approver who is not the person getting it, and every change is logged.
Does the person who keeps the stock also count it and adjust the figures?
Where it applies
MediumThe person who keeps the stock also counts and adjusts it.
The blockerAdjustments over a limit need a second person, and counts are done by someone else.
Do staff declare conflicts of interest (family suppliers, gifts), and is it recorded?
Where it applies
MediumConflicts of interest are not declared or recorded.
The blockerA declaration per person each year, and a blocker on approving work for a declared interest.
How a blocker holds
A step that waits
A workflow step can hold the run until a person in a named role approves it. Approved, the run carries on from that step. Rejected, it stops, with the reason.
Raised when it waits too long
Each approval has a time to answer by. FW Automation raises one that passes it.
Fixes that need a name
A failed check on access, money or customer data cannot be closed without a named approver, and the closing is written onto the failed result.
Want it on your own systems?
We start with an audit: how your operations really run, mapped to the controls you keep.