17 February 2026

Three control gaps we keep finding in payment approvals

Dual-approval theater, shared banking tokens, and weekend urgent payments — patterns that show up often in mid-market Taiwanese finance teams.

Internal control reviews rarely fail because nobody wrote a policy. They fail because the policy and the banking portal live different lives. Here are three gaps that appear repeatedly in our Taiwan fieldwork.

Dual approval that is not dual

Two signatures on a paper request mean little if a single banking token can release the payment. We test the portal roles, not only the stamped forms. If the same person can initiate and release above a threshold, the register will say so.

Shared credentials under time pressure

Small teams sometimes share login devices “just for month-end.” That habit survives long after headcount grows. Interview warehouse and AP staff separately; they often describe practices that managers assume were retired.

Urgent weekend exceptions without logging

Emergency supplier payments happen. The risk is the missing log — no after-the-fact review, no board visibility when exceptions cluster. A simple exception register reviewed monthly costs little and closes a finding we otherwise rate as moderate to high.