What "Tight Systems" Actually Means: Controls Built for the People Who Can Override Them

"Our systems are tight" is one of the most common things a board hears, and one of the least tested. It usually means that a policy exists and that vouchers carry signatures. It rarely means that the business head who wants to get around the system cannot.

The ACFE's Occupational Fraud 2026 report found that override of existing controls was the primary weakness in 19% of cases, alongside a lack of controls in 33%, and that the median loss in schemes by owners and executives was more than nine times that of employees. Senior people do not need to defeat a control. They approve the exception.

Three tests of a tight system

A system is tight when it passes three tests, at every level of seniority:

1. No single person can create and conceal a transaction. Whoever initiates a payment, journal or master data change cannot also approve it, record it and reconcile the account it affects.
2. Every exception leaves a trace that someone independent reads. Overrides, manual journals, urgent payments and configuration changes are logged automatically and reviewed by someone outside the overrider's chain of command.
3. The control is proven with data. Full-population tests show that it worked across every transaction, not only that a sample was signed.

What tight looks like, process by process

Procure to pay

• Vendor creation and bank detail changes handled by a central team independent of buyers, with call-back verification to a number sourced independently.
• System-enforced three-way match of order, receipt and invoice; exceptions blocked, not just flagged.
• Approval limits configured in the system, with blocked self-approval and alerts on orders split below a limit.
• Goods receipt recorded by stores or site staff, not by the person who raised the order.
• Periodic matching of vendor data against employee and director data.

Order to cash

• Customer credit limits set and changed by finance, not sales.
• Discounts, credit notes and scheme payouts approved outside the sales line, with claims tested against secondary sales and stock data.
• Side letters prohibited, and contract terms (returns, price protection, rebates) recorded in the system.
• Review of period-end sales and subsequent returns by distributor.

Record to report

• Manual journals above a threshold approved by someone other than the preparer, with automatic logs of post-closing and top-side entries.
• Reconciliations prepared and reviewed by people who do not post to the account.
• Provisions and estimates documented with assumptions, reviewed by the audit committee where material.

Inventory and assets

• Physical counts by people independent of stores, with surprise counts at high-risk sites.
• Scrap and by-product sales by competitive process, with buyers checked for links to employees.
• Write-offs approved outside the site, and analysed by location and approver.

Payroll and expenses

• Joiners and leavers processed by HR and verified by finance against attendance or access data.
• Bank account changes for employees verified independently.
• Expense claims tested for duplicates, round sums and weekend or holiday patterns.

Access and IT

• No user with conflicting rights, such as creating vendors and approving payments.
• Super-user and administrator access limited, logged and reviewed by someone outside IT.
• Configuration changes to approval limits and workflows logged and reported.

None of this is exotic. Most of it can be configured in the systems companies already use. Our view on process gaps and technology covers where technology helps most.

Designing for override

Tight systems assume that someone with authority will one day want to get around them. Three design principles follow:

• Make override possible but visible. Businesses need flexibility. The answer is not to forbid exceptions but to record every one and route the record to someone independent, ideally internal audit, with a summary to the audit committee.
• Separate the duties that matter. Segregation of duties is most important where one person could create and conceal a scheme. Where a small team makes full separation impossible, compensate with independent review of the output.
• Ask what the control would miss. When a control is tested, ask: "If the person who owns this control wanted to defeat it, how would they do it, and would we notice?"

The board's interest

Directors of listed companies confirm that internal financial controls are adequate and operating effectively (s. 134(5)(e) of the Companies Act 2013), auditors report on them (s. 143(3)(i)) and the audit committee evaluates them (s. 177(4)). When a senior person's fraud surfaces, the first question from the auditor, the regulator and the board will be how the override went unnoticed.

Common mistakes

• More sign-offs. Ten signatures on a voucher do not stop the person who signs last.
• Testing samples of normal transactions. Override happens outside the sample.
• Ignoring IT access. Who holds super-user rights, and who reviews their activity, is often unknown to finance.
• Policy without logs. A rule that exceptions need approval is meaningless if exceptions are not counted.
• Remediating the symptom. After a fraud, companies often add a control to the exact step the fraudster used. The next one uses the step beside it.

Where we can help

Our forensic accounting and data analytics team runs full-population control tests and override reviews, and helps redesign the controls that fail them. Where tests reveal more than a weakness, our investigation team takes it from there. Speak to us in confidence.