Control detail

Payment dual authorization

ctl-004 · PREVENTIVE · CONTINUOUS

ctl-004

Payments above threshold require independent second approval.

Key control
Type
PREVENTIVE
Automation
AUTOMATED
Frequency
CONTINUOUS
Owner
Finance Operations

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

  1. 1.Inspect the payment system configuration confirming payments above threshold require a second independent approver.PR.AA-05
  2. 2.Confirm the initiator of a payment is system-prevented from also approving it (segregation of duties).PR.AA-05

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

  1. 1.Select 25 payments above threshold and confirm each carries a distinct second approval.
  2. 2.Confirm no sampled payment was approved by its initiator.
  3. 3.Test one below-threshold and one above-threshold payment to confirm the threshold triggers correctly.

Linked risks

  • Payment processing errormitigation 3

Framework mappings & latest test

IAM-04IAM-16
Latest test:PASS2026-04-10