Based on the info you have provided I would suggest at the very least: -
- Secure the access by A, B and C with some sort of 2FA;
- Ensure that if a transaction is edited the creator and authoriser(s) are notified, so re-checks can be made (ask for hard copy);
- Incorporate verbal verification (hard to subvert) into the approval chain, repeating this step if a transaction is edited ;
I would also look at the separation of create and approve authorities recommended earlier. But ... that may not be possible if you have a small organisation.
Disclaimer: I'm speaking from experience, not expertise. Best source of advice might be an audit firm.
Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly
to your computer or smartphone by using a feed reader.
