Financial controls scale when they address a defined risk at the point where useful evidence and appropriate authority are available. Adding approvals as transaction volume grows can create queues without improving the quality of challenge. The controller’s design decision is which actions need prevention, which can be monitored after execution, and what evidence makes either approach credible.
The answer depends on consequence and recoverability. A transaction that can be corrected before it affects a customer or financial report may support a different control from an irreversible payment or a consequential reporting judgment. Speed is one objective, but the control must still address the risk it was created to manage.
A useful starting point is one high-volume process, such as customer credits. Map how a credit is requested, supported, authorized, recorded, communicated, and reconciled. Then assess what can go wrong and where the organization could prevent or detect it. This produces a more defensible design than choosing an approval threshold first and assuming that everything below it is safe.
Write the risk in a form the control can address
“Prevent errors” is too broad. For customer credits, distinct risks could include a credit without a valid underlying claim, duplicate credits for the same issue, an incorrect amount, assignment to the wrong entity, or a person issuing credits outside their authority. Each requires different evidence.
State the objective, risk, control action, owner, evidence, and failure response together. For example: the objective is to issue a credit only for an established entitlement; the risk is an unsupported claim; the control compares the request with an approved return or service-resolution record; the owner is the responsible business reviewer; the evidence is the linked record and decision; the failure response is to hold the request and resolve the missing fact.
A sign-off is not inherently a control description. It must establish what the approver examines and what would cause rejection. If three approvers all check the same incomplete information, the process may add delay without introducing a useful independent challenge.
COSO’s 2013 framework links control activities to assessed risks and includes technology controls, information quality, and monitoring. It does not prescribe one approval design for every organization. COSO Executive Summary, Principles 10–13 and 16
Put controls where the evidence originates
A downstream reviewer should not have to reconstruct facts that could have been captured reliably at source. If a credit depends on a return, the process should preserve the accepted return reference. If it depends on a service failure, the business owner should document the agreed resolution and relevant terms.
Automated validation can check that required references exist, the entity and customer agree, the request has not already been fulfilled, and the proposed action fits an approved rule. These checks are useful only if the source records and rules are themselves controlled. A fabricated source record can pass a technically correct match.
Keep authority separate from data completeness. A request can have every field populated and still require a qualified judgment or an authorized exception. The system should make that boundary explicit rather than converting a complete form into implied approval.
Where a process spans several systems, define which one holds the authoritative status and how changes propagate. A revoked approval must not remain valid in a downstream execution queue. Test the interval between approval and action, including whether relevant changes require revalidation.
Combine preventive and detective controls deliberately
A preventive control stops or limits an action before it occurs. A detective control identifies a problem after it occurs. Neither is inherently superior in every circumstance. The choice depends on the exposure during the detection interval and whether a meaningful remedy remains available.
For a routine credit supported by a verified return, a bounded automated rule may be appropriate under the organization’s approved policy. An unusual credit with incomplete evidence may require review before posting. A report of repeated credits to one account can provide a separate detective check on patterns that are invisible at individual-transaction level.
Specify the detection window. “Reviewed monthly” is a schedule, not an assessment of adequacy. Ask what could happen before the review, how many transactions could accumulate, how the issue would be contained, and what correction would still be possible. If the exposure exceeds the organization’s tolerance, move the control earlier or reduce the permitted action.
The 2014 GAO Green Book discusses both preventive and detective control activities and the precision needed to address risk. It is used here as a historical design reference for a US federal framework, not as a current universal business mandate. GAO-14-704G, Principle 10
A hypothetical threshold that misses the pattern
Suppose a hypothetical company permits eligible customer credits below USD 1,000 through a simplified approval route. The limit is an invented teaching example, not a recommended threshold. Fourteen credits of USD 900 are issued to the same customer over several days. Each passes the individual amount test; together they total USD 12,600.
The sequence might represent legitimate separate issues, accidental duplication, deliberate splitting, or something else. The amount pattern alone does not establish misconduct. It does show that a per-transaction limit cannot assess cumulative exposure or whether the same underlying claim has been used repeatedly.
A stronger design could require a unique claim reference, check whether that claim has already been credited, and route unusual cumulative activity for investigation. The controller would define the relevant customer, time window, currency basis, and group of related requests. Those definitions must fit the business rather than being copied from the illustrative numbers.
The response should also depend on the evidence. A duplicate request with the same claim identifier might be blocked pending resolution. Several valid claims could proceed after the appropriate review. A suspicious pattern requires investigation through the organization’s established processes, with care not to treat an automated flag as a proven allegation.
This example shows why scaling controls means improving the unit of observation. Some risks live at transaction level, others at customer, user, supplier, contract, or process level. Raising or lowering one amount threshold cannot address all of them.
Make review capacity part of control design
A control that requires more informed review than the team can perform will either delay the process or become superficial. Estimate the expected queue by case type, the effort needed to inspect the evidence, and the coverage required during absences or peaks.
Do not size the team using an average that hides difficult exceptions. A small number of unresolved claims can consume a large share of reviewer time. Separate ordinary checks from cases requiring business investigation or technical accounting judgment, and provide an escalation route for the latter.
Monitor the age of unresolved items and the quality of decisions, not only approval speed. A fast reviewer who approves unsupported cases is not demonstrating effective throughput. Review a proportionate sample of completed decisions using a method appropriate to the risk, and investigate recurring unsupported approvals or repeated overrides. This article does not prescribe a statistically valid sampling plan.
Offer a legitimate exception route. If the normal approver is absent or an urgent case cannot follow the usual sequence, the business needs an authorized alternative with recorded rationale and appropriate evidence. Informal workarounds become more likely when policy describes no workable response to foreseeable operating conditions.
Control the rules and the people who can change them
Automating a control transfers some risk into configuration and access. A threshold, matching rule, role assignment, or exception route can materially change which transactions proceed. Give those changes an owner, an approval process, representative tests, and a record of the version placed into use.
Assess responsibilities across the full process. A person who can alter the source record, change the validation rule, and authorize the result may bypass the intended separation even if each application displays a different role name. Service accounts and emergency access deserve the same end-to-end consideration.
Where staffing prevents a preferred separation of duties, design and document an alternative control that addresses the actual risk. The historical GAO framework explicitly discusses this situation. An alternative review must be sufficiently independent and informed to be meaningful; simply renaming the same person’s second action does not create separation. GAO-14-704G, paragraphs 10.12–10.14
Preserve the ability to suspend a malfunctioning rule without losing track of pending work. The fallback should specify who takes ownership, which actions pause, and how queued items are revalidated before processing resumes. Test it before the system is carrying the full workload.
Retire controls only with a risk explanation
As processes evolve, controls can become redundant or address risks that no longer exist in the same form. Review them periodically, but do not remove a step simply because no one recalls the last exception it found. Establish its objective, the remaining exposure, and whether another control genuinely covers it.
Likewise, a control that frequently finds problems may be valuable while exposing a preventable upstream defect. Use its results to improve the source process rather than accepting a permanent inspection burden. The goal is reliable operation with proportionate effort, not either the largest control inventory or the fewest approvals.
Start with one slow approval chain. For every step, write the risk it addresses, the evidence examined, and the distinct decision it makes. Move evidence collection to its source, preserve necessary authority, and add pattern-level monitoring where individual checks are insufficient. A scalable control system gives ordinary work a clear path while concentrating informed attention on the exceptions that can cause meaningful harm.
