FAILURE TO ENFORCE DUAL AUTHORIZATION ON HIGH-RISK TRANSACTIONS LEADING TO INTERNAL FRAUD EXPOSURE

Detailed Legal Explanation with Indian Case Laws and Regulatory Provisions

1. Introduction

Dual authorization is a fundamental internal financial control mechanism designed to prevent unauthorized transactions, financial misappropriation and internal fraud within an organisation.

It requires that high-risk financial transactions be initiated by one authorised employee (Maker) and independently verified and approved by another authorised employee (Checker) before execution.

The failure to implement or enforce dual authorization creates an opportunity for employees to misuse their authority, manipulate financial records, transfer funds to fictitious beneficiaries and execute unauthorized transactions without independent scrutiny.

This weakness may expose an organisation to:

Internal fraud and financial misappropriation.

Unauthorized fund transfers.

Manipulation of accounting records.

Abuse of employee access privileges.

Weak corporate governance.

Breach of statutory and regulatory obligations.

Financial losses and reputational damage.

Potential civil, disciplinary and criminal proceedings.

The failure is particularly serious when management is aware of the control deficiency but does not take corrective action.

2. Meaning of Dual Authorization (Maker-Checker Principle)

Dual authorization, also known as the Four-Eyes Principle, is a control mechanism under which two different authorised individuals participate in the processing and approval of a financial transaction.

The Maker initiates the transaction, while the Checker independently verifies the transaction's legitimacy, supporting documents, beneficiary details and compliance with the organisation's policies.

Transaction authorization process

The main objective is to prevent one individual from exercising unrestricted control over the complete financial transaction process.

Examples of high-risk transactions

High-value fund transfers.

Creation of new vendor accounts.

Modification of beneficiary bank details.

Payments to related parties.

Release of loans and advances.

Manual journal entries involving substantial amounts.

Payroll modifications.

Refunds and exceptional payments.

Write-offs and financial adjustments.

Changes to customer account information.

3. How Failure to Enforce Dual Authorization Leads to Internal Fraud

When an organisation fails to enforce independent transaction authorization, it creates an opportunity for employees to misuse their access rights.

Consider the following example:

A finance manager has access to the company's banking platform and is able to initiate and approve payments independently.

The manager creates a fictitious vendor and initiates a payment of ₹50 lakh to the vendor's bank account.

Because the organisation has not enforced mandatory dual authorization, the transaction is processed without independent verification.

The employee subsequently creates fabricated invoices and supporting documents to conceal the transaction.

The fraud may remain undetected because the same employee controls the payment process and supporting accounting records.

Major control weaknesses

A. Absence of segregation of duties

The same employee controls transaction initiation, verification and approval.

B. Excessive system access

Employees have access privileges beyond their actual job responsibilities.

C. Management override

Senior employees bypass established approval procedures.

D. Inadequate transaction monitoring

Large-value or unusual transactions are not independently reviewed.

E. Weak reconciliation procedures

Bank statements and accounting records are not independently reconciled.

F. Inadequate internal audit

Auditors fail to identify repeated deviations from authorization policies.

These weaknesses increase the possibility of fraud and make timely detection more difficult.

4. Applicable Legal Provisions under Indian Law

A. Companies Act, 2013

Section 134(5)(c) – Directors' Responsibility Statement

Directors are responsible for ensuring that proper and sufficient care is taken to maintain adequate accounting records for safeguarding the company's assets and preventing and detecting fraud and other irregularities.

Failure to establish appropriate financial controls may raise questions regarding compliance with this responsibility.

Section 134(5)(e) – Internal Financial Controls

Directors of listed companies must state that adequate internal financial controls have been laid down and that such controls are operating effectively.

The explanation to this provision identifies internal financial controls as including policies and procedures for:

Maintaining accurate business records.

Safeguarding company assets.

Preventing and detecting fraud and errors.

Ensuring accuracy and completeness of accounting records.

Ensuring that transactions are authorised appropriately.

Consequently, failure to enforce dual authorization for high-risk transactions may indicate a weakness in the internal financial control framework.

Section 166 – Duties of Directors

Directors must:

Act in good faith.

Exercise reasonable care, skill and diligence.

Exercise independent judgment.

Promote the interests of the company.

Avoid situations involving conflicts of interest.

Where directors knowingly permit inadequate financial supervision, their conduct may be examined against these statutory duties.

Section 143(3)(i) – Auditor's Reporting Responsibility

The statutory auditor must report whether the company has adequate internal financial controls with reference to financial statements and whether such controls are operating effectively, where applicable.

Failure to maintain proper transaction authorization procedures may therefore become relevant to the auditor's assessment.

B. Bharatiya Nyaya Sanhita, 2023

Where the absence of dual authorization facilitates deliberate financial fraud, the following provisions may become relevant:

These provisions apply to the underlying criminal conduct where their legal ingredients are established. Mere failure to implement dual authorization does not automatically constitute a criminal offence.

C. RBI Regulatory Framework

The Reserve Bank of India issued the Master Directions on Fraud Risk Management in Commercial Banks (including Regional Rural Banks) and All India Financial Institutions, 2024.

The framework emphasises:

Board-approved fraud risk management policies.

Effective fraud prevention mechanisms.

Early Warning Signals (EWS).

Red Flagging of Accounts (RFA).

Staff accountability.

Internal investigation and fraud reporting.

Effective internal monitoring and audit.

For banks, failure to maintain effective transaction controls may raise regulatory and supervisory concerns.

These directions apply to the specified regulated entities and should not be treated as universally applicable to every company.

5. Important Indian Case Laws

The following judgments establish important principles relating to unauthorized transactions, financial accountability, negligence and corporate governance.

Case Law 1: Canara Bank v. Canara Sales Corporation

Supreme Court of India

Citation: (1987) 2 SCC 666; AIR 1987 SC 1603.

Facts of the case

Canara Sales Corporation maintained a current account with Canara Bank.

An employee of the company misused cheque books and participated in a fraudulent scheme involving forged cheques.

The forged cheques were presented to the bank, and the bank debited the company's account.

When the company discovered the fraudulent transactions, it disputed the bank's authority to debit the account.

The bank attempted to rely on the company's alleged negligence in safeguarding its cheque books and detecting the fraudulent transactions.

Legal issue

Whether a bank could debit a customer's account on the basis of forged cheques and avoid liability by alleging negligence on the part of the customer.

Supreme Court's judgment

The Supreme Court held that a forged cheque does not constitute a valid mandate to the bank to make payment.

The Court examined the principles governing forged instruments, negligence and estoppel in the banker-customer relationship.

Mere negligence by the customer does not automatically establish that the bank was entitled to honour forged cheques.

Legal principles established

A bank must act on a valid mandate from its customer.

A forged instrument does not ordinarily authorise payment.

Mere negligence does not automatically establish estoppel.

The legal consequences of negligence depend on the relevant facts and circumstances.

Relevance to failure of dual authorization

This judgment is relevant because it demonstrates the importance of valid authorization before financial transactions are processed.

Where an employee initiates unauthorized transactions by manipulating payment instructions, the organisation must examine whether the transactions were supported by a valid mandate and whether the prescribed verification procedures were followed.

The judgment does not directly establish a universal requirement for two-person authorization, but it provides a useful legal foundation for analysing unauthorized financial transactions.

Case Law 2: N. Narayanan v. Adjudicating Officer, SEBI

Supreme Court of India

Citation: (2013) 12 SCC 152.

Facts of the case

The case concerned financial irregularities and misleading financial disclosures involving a listed company.

Questions arose concerning the responsibility of persons involved in the company's management and financial reporting.

The matter examined the importance of transparency, accountability and integrity in corporate financial affairs.

Legal issue

Whether persons responsible for corporate management and financial disclosures could be held accountable for failures affecting the integrity of financial information.

Supreme Court's judgment

The Supreme Court emphasised that corporate governance requires transparency, accountability and compliance with applicable legal requirements.

Persons responsible for the management and financial affairs of a company must discharge their obligations in accordance with the applicable statutory framework.

Legal principles established

Corporate management must maintain financial transparency.

Financial information must be reliable and accurate.

Persons responsible for company affairs must comply with their legal obligations.

Corporate governance failures can attract legal consequences.

Relevance to failure of dual authorization

Where senior management permits employees to initiate and approve substantial financial transactions without independent scrutiny, it raises questions about the effectiveness of corporate governance and internal financial controls.

This judgment supports the importance of management accountability and the integrity of financial reporting.

However, the case should not be interpreted as directly deciding the legal consequences of a maker-checker control failure.

Case Law 3: S.P. Chengalvaraya Naidu v. Jagannath

Supreme Court of India

Citation: (1994) 1 SCC 1.

Facts of the case

The dispute involved suppression of material facts and fraudulent conduct in judicial proceedings.

The Court considered whether a person who obtained an advantage through fraud and concealment could retain that advantage.

Legal issue

Whether a judgment or advantage obtained through deliberate fraud and suppression of material facts could be sustained.

Supreme Court's judgment

The Supreme Court emphasised that fraud vitiates judicial proceedings and that a person cannot be permitted to retain an advantage obtained through fraud.

Legal principles established

Fraud undermines the legitimacy of legal proceedings.

Suppression of material facts can have serious legal consequences.

A fraudulent advantage cannot ordinarily be protected merely because it has been obtained through formal procedures.

Relevance to internal fraud

Where an employee manipulates transaction records, fabricates supporting documents or conceals unauthorized payments, the underlying fraudulent conduct may have serious legal consequences.

The judgment is relevant to the general principle concerning fraud and concealment, although it does not specifically concern internal financial controls or dual authorization.

Case Law 4: Official Liquidator v. P.A. Tendolkar

Supreme Court of India

Citation: (1973) 1 SCC 602.

Facts of the case

The case involved the responsibilities of directors in the affairs of a company that had suffered serious financial irregularities.

The Court examined the circumstances in which directors could be held responsible for misconduct and failures in the management of company affairs.

Legal issue

Whether directors could be held responsible for company misconduct where they failed to discharge their responsibilities appropriately.

Supreme Court's judgment

The Supreme Court considered directors' responsibilities in the context of the facts and statutory provisions governing the matter.

The judgment recognised that responsibility cannot be determined merely by the designation of a person; the relevant conduct, duties and circumstances must be examined.

Relevance to dual authorization

Where a company suffers financial losses because of weak authorization controls, the conduct of directors and senior management may need to be examined.

Relevant questions include:

Did the directors establish an adequate control framework?

Were they aware of repeated authorization failures?

Did they take reasonable steps to address known deficiencies?

Did they exercise appropriate supervision?

This case is relevant to management accountability, although it does not specifically concern maker-checker authorization.

Case Law 5: S.S. Mani v. State of Tamil Nadu

This case should not be treated as a direct authority on maker-checker controls. For a legal submission specifically dealing with internal fraud and unauthorized transactions, the first two Supreme Court judgments above provide more directly useful principles.

6. Practical Illustration: Internal Fraud Due to Absence of Dual Authorization

Hypothetical case study

ABC Limited has established a financial policy requiring two independent approvals for payments exceeding ₹25 lakh.

However, the banking system has not been configured to enforce the policy.

The finance manager is able to initiate and approve payments independently.

Over six months, the manager transfers ₹2 crore to fictitious vendors.

The transactions are supported by fabricated invoices and false accounting entries.

An internal audit subsequently identifies the fraud.

Legal and audit analysis

Questions that should be investigated

Was a dual authorization policy formally approved?

Were transaction approval limits clearly defined?

Did the banking system permit employees to override approval requirements?

Did management know about the control deficiency?

Were unusual transactions identified through monitoring?

Did employees collude to facilitate the fraud?

Was the internal audit function aware of the weakness?

Would effective independent authorization have prevented or detected the fraudulent transactions?

The investigation should distinguish between the employee's deliberate fraudulent conduct and any separate management or institutional control failures.

7. Responsibilities of Management and Internal Auditors

A. Senior management responsibilities

Senior management should ensure:

Mandatory dual authorization for high-value transactions.

Independent verification of beneficiary details.

Appropriate segregation of duties.

Defined transaction approval limits.

Restricted access to banking platforms.

Periodic review of employee authorization rights.

Proper documentation of exceptional approvals.

Regular monitoring of unusual transactions.

B. Board of Directors' responsibilities

The Board should ensure that an appropriate internal financial control framework is established and monitored.

Where significant deficiencies are identified, the Board should ensure that management takes corrective action within a reasonable period.

C. Internal auditor's responsibilities

The internal auditor should verify whether:

Maker-checker controls are properly designed.

Both approvals are independently performed.

Employees are sharing login credentials.

Transaction limits are configured correctly.

Management overrides are documented.

Vendor additions and modifications are independently verified.

Bank reconciliations are reviewed by independent personnel.

Suspicious transactions are investigated.

Repeated control exceptions are escalated to management.

Previously identified audit observations have been rectified.

An internal control is not effective merely because it exists in a written policy. It must also be implemented and operate consistently.

8. Preventive and Corrective Measures

The organisation should implement the following measures to minimise internal fraud exposure.

Corrective action after identification of fraud

Immediately restrict the compromised employee's transaction access.

Preserve electronic transaction logs and supporting documents.

Conduct an independent forensic investigation.

Identify the persons involved.

Determine the financial loss.

Examine management and supervisory responsibilities.

Initiate disciplinary and legal proceedings where appropriate.

Report the matter to the relevant authorities wherever legally required.

Implement stronger authorization controls.

Conduct a follow-up audit to verify corrective action.

9. Legal Consequences of Failure to Enforce Dual Authorization

The consequences can be examined under three separate categories.

A. Employee liability

Where an employee deliberately misappropriates company funds, fabricates invoices or processes unauthorized transactions, criminal and disciplinary liability may arise.

B. Management liability

Where management knowingly permits serious deficiencies in financial controls or fails to discharge applicable statutory responsibilities, questions may arise under the Companies Act, 2013.

However, management liability is not automatic merely because an employee commits fraud.

C. Organisational and regulatory exposure

The organisation may face:

Financial losses.

Audit qualifications or adverse internal control findings.

Regulatory scrutiny.

Litigation and recovery proceedings.

Reputational damage.

Additional compliance and remediation costs.

The applicable consequences depend on the organisation's legal status, industry, statutory obligations and the facts of the incident.

10. Suggested Internal Audit Observation

The following is a formal audit observation suitable for an internal audit report.

Audit Observation Title: Failure to Enforce Dual Authorization on High-Risk Transactions Leading to Internal Fraud Exposure

Observation:

During the course of the audit, it was observed that the organisation had not adequately implemented and enforced mandatory dual authorization controls for high-risk financial transactions.

The existing transaction processing arrangements permitted employees to initiate and, in certain circumstances, approve or execute financial transactions without effective independent verification.

Furthermore, adequate segregation of duties, transaction approval limits and independent monitoring mechanisms were not consistently implemented.

This weakness increases the risk of unauthorized transactions, fictitious vendor payments, manipulation of accounting records, financial misappropriation and potential collusion among employees.

The absence of effective maker-checker controls also increases the possibility that fraudulent transactions may remain undetected for an extended period.

Risk and implications:

Increased exposure to internal fraud and financial misappropriation.

Unauthorized movement of company funds.

Weak accountability and financial governance.

Potential non-compliance with applicable internal financial control requirements.

Increased risk of financial statement misstatement.

Potential management and regulatory accountability.

Legal and regulatory references:

Companies Act, 2013 – Section 134(5)(c).

Companies Act, 2013 – Section 134(5)(e), where applicable.

Companies Act, 2013 – Section 143(3)(i), where applicable.

Companies Act, 2013 – Section 166.

Bharatiya Nyaya Sanhita, 2023 – Sections 316, 318, 336 and 340, where the relevant criminal offences are established.

Canara Bank v. Canara Sales Corporation (1987) 2 SCC 666.

N. Narayanan v. Adjudicating Officer, SEBI (2013) 12 SCC 152.

Recommendation:

Management should immediately implement mandatory dual authorization for all high-risk financial transactions. Transaction initiation and approval responsibilities should be assigned to separate authorised employees, with system-based restrictions preventing any individual from independently initiating and approving the same transaction.

The organisation should also establish risk-based approval limits, independent verification of beneficiaries, periodic access reviews, automated exception reporting and regular internal audit testing.

Management should investigate any previous unauthorized transactions, quantify potential losses and initiate appropriate corrective and disciplinary action.

11. Conclusion

Failure to enforce dual authorization on high-risk transactions represents a significant weakness in an organisation's internal financial control and corporate governance framework.

When one employee is able to initiate, approve and execute financial transactions without independent verification, the organisation becomes vulnerable to fraudulent payments, financial misappropriation, manipulation of accounting records and concealment of irregularities.

The legal principles recognised in Canara Bank v. Canara Sales Corporation and N. Narayanan v. Adjudicating Officer, SEBI, together with the statutory responsibilities prescribed under Sections 134, 143 and 166 of the Companies Act, 2013, provide an important framework for examining financial authorization failures and management accountability.

Organisations must therefore ensure that independent authorization mechanisms are not only formally established but also effectively implemented, periodically monitored and independently tested.

Ultimately, dual authorization is not merely an administrative procedure; it is an essential preventive control for protecting organisational assets, strengthening financial accountability, reducing internal fraud exposure and maintaining confidence in corporate governance.

12. Summary of Case Laws

Final legal clarification: These judgments establish related legal principles; none should be represented as a direct Supreme Court ruling that specifically mandates dual authorization for all high-risk transactions. The legal requirement for a particular organisation must be assessed against the applicable statute, RBI directions, internal policies and industry-specific regulations.

This explanation is based on Indian law and is structured for internal audit, risk management, compliance and corporate governance reporting. No external hyperlinks are included.