eProcureAI / Platform / Financial services
IndustryA control that depends on somebody remembering is not a control. Separation of duties, due diligence and override logging all need to run whether or not anyone is paying attention that week.
Enforced structurally. Including through delegation, which is the loophole most implementations miss.
Financial services firms rarely lack procurement controls. What they lack is confidence that the controls ran on every transaction rather than on most of them.
Separation of duties is written down. Then somebody covers a colleague during annual leave, the delegation chain quietly hands them both roles, and for two weeks one person can request and approve the same purchase. Nobody notices, because nothing tells them.
Due diligence is required before engaging a third party. Then a business unit urgently needs a supplier, an exception is granted verbally, and the diligence is completed afterwards if at all.
A control enforced by the system runs every time, including in a busy quarter and including through a delegation. A control written in a policy runs when somebody remembers it.
That difference is the whole argument. The same person cannot request, approve and release payment, and no delegation arrangement can create that combination, because the system will not allow it rather than because a document says it should not happen.
When every approval carries who decided, when and why, and every override is recorded as an override, producing evidence is a filter and an export. The alternative is a fortnight of asking people to forward emails and hoping they still have them.
Not most. A sample showing exceptions nobody can explain is worse than no sample.
Including through delegation, which is where most firms discover a gap.
Before the first payment, with the date visible, rather than completed retrospectively.
Overrides recorded as overrides rather than blended into normal activity.
Quickly, with documents attached, rather than after a fortnight of collection.
The combination that matters is request, approve and pay. Blocking it in normal operation is straightforward. Blocking it through a delegation chain is the part most implementations forget.
A supplier cannot receive an order until diligence is complete and risk has approved. The urgency conversation happens before the commitment rather than after it.
Every exception carries an approver, a reason and a date, and is reportable on its own. A firm that cannot list its exceptions does not really know what its controls did.
Applying the same onboarding to a stationery supplier and a data processor wastes effort in one place and misses risk in the other.
| Tier | Typical supplier | What is collected | Re-review |
|---|---|---|---|
| Low | Office consumables, no data access | Standard onboarding, tax and banking | Annual validity |
| Medium | Facilities, on site services | Adds insurance and site requirements | Annual, with document expiry tracked |
| High | Data processors, outsourced functions | Adds ownership, screening, security review | More frequent, with named owner |
| Critical | Functions your operation depends on | Adds continuity and exit considerations | Scheduled and escalated |
Tiering is the difference between diligence that is proportionate and diligence people route around because it is uniformly heavy.
Cover arrangements quietly combining request and approve. The most common structural gap.
A verbal exception that never gets closed out, discovered later by somebody else.
Permissions carried from a previous position because access followed the person.
Several orders staying just below a limit, which is visible when you look for repeat patterns.
The most common fraud route, closed by verifying every change before payment.
Insurance and certifications tracked to a date rather than checked at onboarding only.
The point of structural controls is that a busy quarter changes nothing about whether they ran.
Buy things, and answer for the exceptions. The routine controls do not need their attention.
Runs the controls on every transaction, without exception and without reminder.
We will map it onto the system and show you which controls become structural rather than procedural.
Book your free demoRelated: All solutions and Access and Permissions