Four-Eyes Principle: Where the Second Check Fails

A bank acts on paper and screens. A wrong digit in a limit, a payment sent to the wrong account or a mortgage discharged over the wrong title can cost more than the year's margin on the customer, and some of these mistakes cannot be undone once registered or paid. Two people reduce the chance of an honest error getting through, and they change the economics of dishonesty: a fraud that needs one person needs only temptation, while one that needs two needs a conspiracy.

The principle runs through the whole lending cycle. In credit, above the small amounts some banks delegate to their bankers, whoever brings in a loan cannot sign it off; a credit officer with delegated authority does, or a credit committee for larger cases. In lending operations, whoever enters a facility, a drawdown, a fee waiver or a security release in the system cannot also authorise it. In payments, one person sets up or changes a payee and another releases the money. The Basel Committee's operational risk principles treat segregation of duties and dual controls as part of a sound control environment, warning that conflicting duties without them can conceal losses and errors.

The maker assembles the transaction from its sources: the credit approval, the signed documents, the customer's instruction, the title or registration search. The checker's job is to confirm that what the maker has keyed matches those sources, not that it matches what the maker says. The difference is everything. A checker who compares the screen to the maker's own cover note confirms that the maker was consistent with themselves.

Systems enforce the mechanics. The checker must log in as a different user, often with a higher authority for larger amounts, and the transaction stays pending until approved. What a system cannot enforce is attention. The check weakens in recognisable ways: under volume, when a queue of a few hundred items a day turns review into clicking; under pressure, when a relationship banker says the customer needs it today; when the checker lacks the knowledge to read the source, such as a title search; when a temporary login lets one person act as both; and, rarely, when maker and checker agree to deceive.

A fitness-club operator, constructed for this page like every figure in it, owns two freehold sites on the same road and borrows US$6.2m against first mortgages over both. It sells the smaller site for US$3.4m. Credit approves the release of that site's mortgage against repayment of US$2.9m, leaving the larger site as security.

The operator's lawyer, acting on the sale, sends the bank a discharge request that quotes the title reference of the larger site by mistake; the two titles differ by one digit. The maker in lending operations prepares the discharge from the request. The checker compares the discharge to the request, finds them identical, and approves. The discharge is registered against the larger site's title. Until the error is found, US$6.2m is secured on a site worth US$3.4m, and it surfaces only when the sale cannot settle because the sold site's mortgage is still on its title.

Had the checker worked from the credit approval and a current title search, the mismatch was in plain sight: the approval named the smaller site by address and title. The bank now has to ask the operator for a fresh mortgage over the larger site. A cooperative customer will give it, but the new mortgage ranks behind anything registered in the gap, and new security given for an existing debt can be open to challenge if the company fails soon after.

The terms overlap and are often used loosely. Segregation of duties is the wider design rule: incompatible tasks, such as setting up a payee and releasing payments to it, or approving a loan and recording its repayments, are kept in different hands permanently. The four-eyes principle is one way of applying it to a single transaction, by requiring a second, independent person to confirm before the transaction takes effect. Dual control is stricter still: two people must act together at the same moment, as with two keys to a vault or two halves of a password, so neither can act alone even briefly.

A credit committee is the four-eyes principle with more eyes, used where a decision is large or unusual enough that one approver's judgment is not thought sufficient. It fails in the same way: when members read the paper they are given rather than the business it describes.

DEFINED IN ONE PARAGRAPH → · HOW BANKS APPROVE BUSINESS LOANS → · PARTIAL RELEASE →

Inside the bank, the principle is why most loans are approved by someone other than the person rewarded for selling them, and why a policy exception goes to someone more senior than the proposer. It is also why a release, a limit increase or a drawdown takes a day when the customer wants it in an hour, and a relationship manager who pushes the checker to skip a step is asking the bank to carry a risk nobody approved.

Outside it, a lender reads the same control in the borrower. A business where one person sets up suppliers, keys payments and reconciles the bank account has no second reading, and is the business most exposed to business email compromise and to fraud by its own staff. Small companies cannot easily separate duties, so the lender looks for a compensating check, such as an owner who approves every new payee and reads the bank statement each month. The auditor's letter to management is often where the gap first appears.

THE BANK IN YOUR AUDIT FILE → · THE LENDING OPERATIONS PAPER →