Field notes
How mid-sized firms miss segregation gaps before year-end
Approvals that look fine on paper often collapse when one person covers two roles during leave season.
Leave coverage is where control design meets reality. A controller who also posts journals “just for two weeks” can erase months of careful role design. Before external auditors arrive, map who can initiate purchases, who can approve invoices, and who can change vendor bank details — then ask what happens when any one of those people is away.
For operating companies in Taiwan with lean finance teams, perfect four-way splits are rarely realistic. Compensating reviews — a weekly vendor master change report signed by a second manager, or a forced dual release for payments above a threshold — often close more risk than an unread policy page.
Bring last quarter’s user access exports to the conversation. Paper matrices drift; system rights show who can actually post.