How Governance Intelligence Can Strengthen Trusted Approval Processes Without Destroying Trust

Case limitation and analytical disclaimer

Four-Eyes Principle – This article presents an anonymised and partially reconstructed governance case inspired by publicly reported events. Certain circumstances, process details, transaction patterns and hypothetical Governance Control Navigator (GCN) observations have been adapted or added for analytical purposes. The case should therefore not be interpreted as a factual reconstruction of the organisation concerned, the individuals involved or the controls that actually operated at the time.

The underlying public case concerned a finance employee who progressed to become the senior finance executive of a logistics company and, over approximately 9 years, transferred around €3.7 million of company funds to himself. The publicly reported facts include the introduction of a four-eyes banking control, the role of trust within a small finance team and the eventual discovery of an unexplained balance following the acquisition of the company.

The purpose of this article is different. It explores how traditional Governance, Risk & Compliance (GRC) can be enriched by continuously evaluating whether the practical operation of controls remains aligned with their intended Governance Design.

---

1. It Started With €600

Imagine a medium-sized company with a small finance department.

People know one another. They have worked together for years. The finance team is experienced, trusted and close to the business. Payments are processed every day and, as in thousands of comparable organisations, efficiency depends partly on professional trust.

One employee transfers €600 of company money to himself.

That first amount is almost insignificant compared with what eventually follows.

In the real case that inspired this anonymised example, the employee later told the court that the first €600 was used to buy a racing bicycle. What began as a relatively small transfer ultimately developed into approximately €4.2 million being diverted over a period of about ten years. During those years, the employee progressed from finance employee to the person with ultimate responsibility for the company’s finances.

With hindsight, €600 therefore looks enormously significant.

But that is precisely the problem with hindsight.

At the moment the transaction occurred, it was simply €600 within the financial bloodstream of a functioning company.

That distinction matters.

Governance systems cannot operate on the assumption that every unusual payment represents fraud. Modern businesses process thousands, sometimes millions, of legitimate exceptions. Employees make mistakes. Suppliers change bank accounts. Expense reimbursements occur. Manual payments are necessary. Urgent transactions arise.

An effective governance system therefore needs more than anomaly detection.

It needs context.

And, above all, it needs to understand when seemingly insignificant individual events begin forming a meaningful pattern.

That gives us the first question in this case:

At what point does an individual transaction stop being an exception and become a governance pattern?

Traditional GRC and Governance Control Navigator approach that question from different directions.

GRC establishes the rules governing the transaction.

GCN adds a continuous view of how transactions, users, approvals and exceptions actually behave within those rules.

The distinction becomes particularly important when the organisation subsequently strengthens its controls.

Because that is exactly what happened.

---

2. The Company Improved Its Controls

One of the most instructive aspects of the underlying case is that the company did not simply continue operating indefinitely with one individual having unrestricted payment authority.

Its banking arrangements changed.

And with that change came an important improvement in internal control:

the four-eyes principle.

According to the reported case, payments initially could be made using a bank authentication device. Following a change of bank, a second person was required to approve payments. On paper, this represented an obvious improvement in Governance Design.

One person initiates.

Another person approves.

The fundamental logic is familiar to almost every finance professional.

Segregation of Duties reduces the risk that one individual can initiate and complete an inappropriate transaction without another person becoming involved.

In GRC terminology, the organisation had introduced a preventive control.

The control objective might have been expressed along the following lines:

Payments above the applicable threshold require independent authorisation by a second appropriately authorised employee before release.

Clear.

Logical.

Auditable.

And entirely sensible.

A conventional GRC environment could subsequently establish whether authorised roles had been configured correctly, whether incompatible permissions were separated and whether payment records contained the required second approval.

A control tester could select a sample of payments and establish:

Initiator: User A
Approver: User B
Authorised users: Yes
Required approval: Present
Payment released after approval: Yes

Control performed.

But something had changed that the technical evidence alone could not necessarily demonstrate.

The finance team was small.

The people involved knew and trusted one another.

The article describes the practical reality very simply: when the finance executive asked somebody to approve a payment, that colleague would do so. It was based on trust.

Suddenly, the distinction between Governance Design and Governance Execution becomes critical.

The control had improved.

But had independent scrutiny improved by the same amount?

Read more form the FBI: Common Frauds and Scams.

---

3. The Problem Was Not Trust

The easiest lesson to draw from a case like this would be:

Do not trust employees.

It would also be the wrong lesson.

Organisations cannot function without trust.

A finance department in which every employee treats every colleague as a potential fraudster would quickly become dysfunctional. Controls would become obstacles rather than safeguards. Decisions would slow down, administrative costs would increase and experienced professionals would spend their time proving their innocence rather than running the business.

Trust is therefore not the enemy of internal control.

Indeed, trust is part of the organisational capital on which effective businesses depend.

The governance problem arises when trust silently begins to replace the substance of a control.

Consider the second approver.

A colleague asks:

“Could you approve this payment for me?”

The colleague has worked for the company for years.

He understands Finance.

He has greater knowledge of the underlying transactions than many of the people around him.

Nothing problematic has previously come to the approver’s attention.

Why would the approver distrust him?

So the payment is approved.

Tomorrow there is another one.

And another next month.

Gradually, an important behavioural transformation can occur.

The second approval remains technically present, but the mental process behind it changes.

Instead of:

“I am independently reviewing whether this payment should be released.”

it becomes:

“My trusted colleague has asked me to complete the second authorisation.”

The mouse click is identical.

The User ID is different.

The timestamp is recorded.

The audit trail is complete.

But the governance substance may no longer be the same.

That leads to one of the most important distinctions in this entire case:

Trust becomes a governance risk not because trust is undesirable, but when trust becomes an undocumented substitute for independent control execution.

This is also why simply introducing additional controls does not necessarily solve the underlying problem.

A third approver could eventually develop exactly the same behavioural routine.

The issue is not the number of electronic signatures.

The issue is whether those signatures continue to represent genuinely independent decisions.

---

4. Traditional GRC Sees a Valid Approval

This is where the distinction between GRC and GCN becomes particularly tangible.

Suppose an Internal Audit team tests payment controls.

The organisation’s control matrix states that certain payments require two authorised individuals.

The auditor extracts a sample.

For the selected payment, the system demonstrates that User A initiated the payment and User B subsequently approved it.

User A and User B are different employees.

Both had valid access rights.

Their respective authorisation limits were sufficient.

The approval occurred before the payment was released.

There is no obvious Segregation of Duties conflict in the access matrix.

From the evidence available for that individual transaction, the four-eyes control may appear to have operated exactly as designed.

That conclusion is not necessarily wrong.

This is important.

GCN should not be positioned by pretending that conventional GRC or Internal Audit has somehow failed merely because a later fraud becomes known.

The control test answers the question it was designed to answer:

Was the required second approval present?

Governance Control Navigator adds a different question:

Does the broader pattern of approvals provide evidence that the second approval is functioning as an independent review?

Now the unit of analysis changes.

Instead of examining only one payment, consider six months of payment behaviour.

Perhaps User B approves an unusually high proportion of User A’s payments.

Perhaps the relationship is reciprocal.

Perhaps User A also approves most payments initiated by User B.

Perhaps their approval times are consistently much shorter than those of comparable approvers.

Perhaps neither employee rejects, returns or questions payments initiated by the other.

Perhaps one approval relationship becomes increasingly dominant as the years progress.

None of these observations proves wrongdoing.

That cannot be emphasised strongly enough.

There may be perfectly legitimate explanations.

The two employees may work on the same portfolio.

One may be the designated deputy for the other.

A small finance team may simply have few realistic approval combinations.

Urgent payment processes may legitimately produce rapid approvals.

But taken together, these observations create a legitimate governance question:

Is the control still operating with the degree of independence its designers intended?

Traditional GRC establishes whether the control occurred.

GCN helps management examine the behaviour of the control itself.

---

5. The Difference Between Control Design and Control Substance

This brings us to the central proposition of Part 1.

Governance controls have both form and substance.

The form of a four-eyes control is relatively straightforward:

two appropriately authorised individuals participate in the transaction.

Its substance is more demanding:

the second individual provides a sufficiently independent challenge before the transaction is completed.

A computer system can establish the first relatively easily.

The second requires context.

This is where Governance Intelligence can enrich GRC.

GCN does not need to conclude that an approver failed to perform a proper review. Instead, it can continuously evaluate behavioural characteristics surrounding the control.

For example, does an approver normally take several minutes to approve significant payments but approve payments from one particular colleague almost immediately?

Does an approver occasionally reject transactions from most initiators but never reject those of one particular person?

Does one initiator-approver combination occur far more frequently than organisational structure alone would predict?

Are unusual beneficiaries disproportionately associated with the same approval pair?

Does approval behaviour change when people are absent?

Do transaction amounts gradually increase while the approval relationship remains unchanged?

Each observation is weak evidence on its own.

Together, they may become valuable Governance Intelligence.

And that is the crucial difference.

GCN is not attempting to prove that the four-eyes principle has failed.

It is continuously asking whether the observable behaviour surrounding the control remains consistent with its governance purpose.

The distinction can be expressed very simply:

Traditional GRC can demonstrate that two different User IDs approved the transaction.

GCN adds the question whether those two User IDs continue to behave like two independent decision-makers.

That does not weaken GRC.

It strengthens it.

The four-eyes principle remains the Governance Design.

Segregation of Duties remains essential.

Authorisation limits remain essential.

Internal Audit remains essential.

GCN adds a feedback loop between the control as designed and the control as experienced in organisational reality.

And that matters because, in the case that inspired this article, the introduction of a second approval did not bring the underlying behaviour to an end. The reported conduct continued for years and was ultimately exposed only after the company was acquired and an unexplained accounting item attracted attention during a review of the books.

That gives us a much more useful governance lesson than simply saying that somebody should have checked more carefully.

The lesson is that a control can exist, be executed and leave a complete electronic audit trail while still gradually losing part of the behavioural substance for which it was designed.

In the next chapter, we therefore move beyond the individual payment.

Because €600 tells us very little.

Even €10,000 may tell us very little.

The real power emerges when transactions, users, beneficiaries, approval relationships, timing and exceptions are connected over time.

That is the point at which a series of ordinary transactions can become something much more important:

a visible pattern of governance divergence.

6. One Payment Tells You Almost Nothing

The uncomfortable reality of payment fraud is that an individual transaction often looks remarkably ordinary.

A payment of €600 does not automatically attract attention. Neither does €2,500, €7,500 or even a substantially larger amount in an organisation processing significant payment volumes.

Businesses make unusual payments every day.

There are advances, refunds, settlements, urgent supplier payments, employee expenses, tax payments, intercompany transfers and manual corrections. Amounts vary. Beneficiaries change. Transactions sometimes fall outside the normal payment run.

That is why simply lowering authorisation limits or creating ever more exception reports is unlikely to solve the underlying governance problem. The result may simply be thousands of additional alerts that Finance has neither the time nor the reason to investigate.

The publicly reported case that inspired this article illustrates the difficulty particularly well. The behaviour reportedly began with a relatively small amount and continued over many years. At one point, an exceptionally large payment was made, followed by a period in which the behaviour stopped before eventually resuming.

That is very different from a simple scenario in which somebody suddenly transfers an enormous amount and everybody should obviously have noticed.

The individual payment is therefore not necessarily the most interesting governance object.

The pattern may be.

GCN would not ask only:

Is this payment unusual?

It would also ask:

Does this payment belong to a developing pattern that is unusual?

That sounds like a small distinction.

In practice, it changes the analysis completely.

---

7. The Approval Relationship Becomes Part of the Control

Consider again the four-eyes principle.

Traditional GRC defines the control appropriately:

one person initiates the payment and another authorised person approves it.

The control can be configured in the banking environment. Access rights can be tested. Authorisation limits can be reviewed. Internal Audit can select transactions and verify that two separate User IDs participated.

GCN does not need to change any of that.

Instead, it can add the relationship between those users to the analysis.

Suppose Finance has six people authorised to provide second approval.

Over twelve months, most payment initiators have their transactions approved by several different colleagues.

But one particular initiator behaves differently.

Perhaps 80% of that person’s manually initiated payments are approved by the same colleague.

Again, that may be perfectly reasonable.

They may work together closely.

Their responsibilities may overlap.

Other authorised colleagues may frequently be unavailable.

A pattern is not a finding.

Now add another dimension.

The same approver normally takes several minutes to review significant payments initiated by other colleagues but approves this person’s transactions considerably faster.

Still explainable.

Then another.

The approver occasionally returns or rejects payments submitted by other colleagues but virtually never does so for this particular initiator.

And another.

Payments involving unusual beneficiaries are disproportionately present within the same initiator-approver relationship.

No single observation proves anything.

But collectively they begin to tell management something about the practical operation of the control.

This is where GCN enriches GRC.

The question is no longer merely:

Were two people involved?

It becomes:

Does the observed relationship between those two people remain consistent with the independent review that the four-eyes principle was designed to create?

That is not fraud detection.

It is control intelligence.

---

8. GCN Does Not Need to Know That It Is Fraud

This distinction is crucial.

Governance Control Navigator should not attempt to determine from transaction patterns that an employee is stealing from the company.

That would turn Governance Intelligence into a pseudo-forensic system and create precisely the wrong management behaviour.

There are too many legitimate explanations for unusual transactions.

Instead, GCN looks for governance divergence.

Imagine that payments associated with one finance role gradually begin to differ from the normal population.

The differences might involve:

• recurring beneficiary relationships;
• unusual payment timing;
• concentrations around particular approval combinations;
• increasing transaction values;
• payments outside normal processing cycles;
• unusually rapid second approvals;
• almost complete absence of rejected or returned transactions.

None of those characteristics means:

fraud.

They mean:

different.

And “different” is enough to justify a proportionate governance question.

This distinction also protects employees.

The purpose of continuous monitoring should never be to create an environment in which every deviation makes somebody a suspect.

A deviation may reveal a badly designed process.

It may reveal insufficient staffing.

It may show that the authorisation matrix no longer reflects actual responsibilities.

It may reveal that one experienced employee has become indispensable.

It may simply identify a perfectly legitimate business activity that should be incorporated into the normal governance model.

The objective is therefore to understand the deviation.

Not to criminalise it.

GCN does not detect the fraud.

GCN detects that Governance Reality no longer behaves as expected.

What management subsequently discovers is a matter for management, Compliance, Internal Audit or, where appropriate, a formal investigation.

---

9. When the Pattern Suddenly Changes

The original reported case contains another particularly interesting element.

At one stage, a very substantial payment was reportedly made to the employee himself. The explanation later given was that a decimal or comma error had caused a much larger amount to be transferred than intended. Following that event, the behaviour stopped for a period before subsequently resuming.

For a traditional transaction-control environment, the large payment itself is obviously interesting.

For GCN, the change in behaviour before and after the event may be equally interesting.

Imagine a payment pattern developing gradually over several years.

Then suddenly:

the pattern stops.

For months, the previous activity disappears.

Later it returns.

That behavioural interruption provides information.

Not proof.

Information.

GCN is not limited to detecting increasing transaction volumes. It can also identify changes in frequency, concentration, timing and relationships.

A pattern can accelerate.

It can migrate.

It can disappear.

It can reappear.

And these changes can be compared with other organisational events.

Did the approval matrix change?

Did someone go on leave?

Was a new bank introduced?

Did responsibilities move?

Was Internal Audit reviewing the process?

Did management introduce an additional control?

Again, correlation is not causation.

But governance becomes considerably more informative when management can observe how actual behaviour responds to changes in the control environment.

This is particularly important when controls are strengthened.

If management introduces dual authorisation, GCN should not merely record:

Control implemented: completed.

It should subsequently ask:

Did transaction and approval behaviour actually change?

That is the beginning of measurable governance improvement.

---

10. From Anomaly to Governance Divergence

Now imagine that GCN combines the available information.

Not one transaction.

Not one user.

Not one unusual beneficiary.

But several months or years of payment behaviour.

The resulting governance observation might read:

Payment activity associated with a finance role has progressively diverged from comparable payment behaviour. The same approval relationships recur disproportionately, selected payments fall outside normal processing patterns and second-authorisation behaviour differs from the wider peer group. Management review is recommended to determine whether the current payment-control design remains effective in practice.

Notice what GCN has not said.

It has not said:

Employee fraud detected.

It has not said:

The approver is colluding.

It has not even concluded:

The four-eyes control has failed.

There is insufficient evidence for any of those conclusions.

GCN has done something much more modest and, from a governance perspective, potentially much more useful.

It has made an emerging pattern visible.

Management can now investigate the explanation.

Perhaps Finance is understaffed and the same two people have little choice but to authorise each other’s payments.

Then the appropriate response is not disciplinary action.

It is to solve the staffing or authorisation problem.

Perhaps unusual manual payments have increased because the ERP workflow no longer accommodates a particular business process.

Then the process should be redesigned.

Perhaps the second approver receives insufficient supporting information to perform a meaningful review.

Then the approval screen or procedure should be improved.

And yes, perhaps further examination ultimately identifies inappropriate transactions.

But that conclusion comes after investigation, not from the GCN signal itself.

This distinction matters because it changes the relationship between the business and Governance, Risk & Compliance.

GRC should not become the department that appears periodically with another exception list and asks operational management to explain itself.

GCN can make governance more constructive.

A divergence is identified.

The reason is understood.

A practical solution is actively pursued.

The solution is documented.

Responsibility is assigned.

The appropriate level of management authorises it.

And then comes the part traditional remediation processes can sometimes find difficult:

GCN continues observing the process to determine whether the solution actually changed Governance Reality.

That is where continuous monitoring becomes more than continuous control testing.

It becomes continuous improvement.

Because the real lesson from this case is not that the company needed a third approver, a fourth signature or another page in the Finance Manual.

The organisation already had a control.

The more interesting question is how GRC and GCN together can ensure that the control continues to work in substance, not merely in form.