Dual approval requires two authorized people to approve a defined action before it can proceed. It is used to reduce error, fraud and unilateral control over sensitive payments, supplier changes, contracts and system access.
Which actions may require it?
- High-value or unusual payments
- Changes to supplier bank details
- New beneficiaries or payout accounts
- Manual refunds and write-offs
- Nonstandard contracts or pricing exceptions
- Privileged access and control overrides
How should the control work?
The two approvals should come from independently authorized roles. Each approver should see the same final record, understand the decision basis and be prevented from approving after a material change without renewed review.
Dual approval vs. sequential review
Dual approval means two valid approvals are required. Sequential review only describes order; the second reviewer may be advisory unless policy makes both decisions mandatory. The workflow should state whether either approver can reject or return the request.
What weakens the control?
Shared credentials, rubber-stamping, self-approval through multiple roles, unlogged offline consent and allowing the preparer to choose an unauthorized substitute all undermine independence.
What should the audit trail show?
Record the submitted version, supporting evidence, identities, authority levels, decisions, timestamps and any changes made afterward. A payment status alone does not prove that two valid approvals occurred.
