The four-eyes principle: definition, examples, limits

Two people instead of one: at first that sounds like twice the work. In fact the four-eyes principle is the simplest control there is — and in most loss cases the one that was missing.

What the principle requires

The rule is short: an important decision is not taken, released and carried out by one person alone. A second person looks at the same case and confirms it.

Behind it sit two risks that are often conflated:

• Error: a mistyped figure, a service that was never delivered, an invoice that arrives twice.
• Abuse: someone creates a fictitious supplier and transfers money to themselves.

The same measure helps against both. The second person finds the error. The abuse they prevent simply by existing.

Where it is mandatory — and where it is not

For most small and medium-sized companies there is no explicit duty. The principle becomes binding where supervisory law requires an internal control system: banks, insurers, fund managers.

That does not make it irrelevant for everyone else. Two things create pressure:

• The auditor assesses the internal control system. Where material amounts pass without any separation, that is a finding.
• Fidelity insurance asks after a loss which controls were in place. A payment one person could trigger alone is a poor start.

Four eyes and separation of duties are not the same thing

The two terms are often used interchangeably, but they work on different levels:

• Four-eyes principle: the individual case. Two people look at the same decision.
• Separation of duties: the organisation. Whoever captures invoices does not run the bank. Whoever maintains master data does not release payments.
• Signing authority rule: the principle in numbers. Who signs alone up to which amount, and from where two signatures are needed.

The most dangerous gap is not a missing second signature. It is a person who may both change master data and pay. Then the second signature helps little — it is looking at a case that appears correct.

Three examples from mid-sized companies

Invoice approval. The classic case. One person brings the invoice into the system, a second checks the service, and above a set amount a third agreement is needed. How that works with thresholds and policies is on the page about invoice approval.

Payment release at the bank. Two authorised signatories release the payment run. Most companies already have a separation here — but it only bites at the very end, long after the check should have happened.

Changes to master data. The most often overlooked point. When a supplier’s bank details change, someone who did not make the change should confirm it. This is exactly where fraud by forged email takes aim.

Where it breaks down in practice

Agreeing the principle is quick. Whether it holds is decided in three places:

• Holiday and illness. If the second signature is missing for two weeks, it gets bypassed — not out of bad faith, but because invoices fall due. Cover arrangements belong in the rule, not in a footnote.
• Small teams. With three people there is no clean separation. The honest answer: bound the principle rather than claim it. Set thresholds so that only relevant amounts need two approvals — the second stays with management.
• The quiet exception. Direct debits, PayPal, charges from advertising accounts: the money is gone before anyone could agree. Those documents still go through the check — after the fact, with the same record. With company cards that can be moved up front: the approval is the card itself, with a limit and an owner — the receipt reaches the system as a photo.

What belongs in writing

A principle that exists only in people’s heads is not there when it is examined. Three things belong in a written rule:

1. Who approves what — alone up to which amount, jointly from where.
2. Who covers for whom during absence, and for how long.
3. Which exceptions exist and how they are checked afterwards.

Anyone who maps approvals in software gets the evidence along the way: every sign-off is recorded with person and timestamp and can be shown years later. A “fine by me” in passing cannot.