Duplicate vendors and the quiet second payment
How a second supplier record with the same bank account can pass every invoice approval and still be a control failure.
Invoice approval workflows judge the document in front of them: three-way match, amount, and a familiar supplier name. They rarely ask whether that name is the only record pointing at the same bank account.
In our vendor-master reviews we look for shared accounts, near-duplicate legal names, and bank-detail changes that never entered the dual-control queue. Those changes sit upstream of the approval you are proud of.
If master-data amendments can be completed by the same person who raises invoices, the later approval trail is decorating a decision that already happened.