In many Tainan and Kaohsiung companies, the same colleague who keys vendor invoices also prepares payment runs. That arrangement works until a busy month collapses the informal checks that used to catch duplicates.
An internal controls review does not demand a Fortune 500 org chart. It asks whether initiating, approving, and recording can be split in time or by secondary review, even if the headcount stays lean.
Practical options include rotating payment release passwords, requiring dual sign-off above a clear threshold, and keeping the bank statement download outside the person who posts cash.
When we walk through disbursements, we look for evidence that those splits actually happened in the sample period—not merely that a policy binder says they should.
If your team cannot separate duties further, compensating reviews become the control: a monthly exception report reviewed by someone outside the payment chain, with initials and dates retained.