The four-eyes principle for small businesses

The four-eyes principle is simple: an important action is never carried out by one person alone. Someone does it, a second person checks and approves. Banks, auditors and governments have worked this way for decades. For a small or medium-sized business it’s at least as useful, but it has to work differently. You don’t have an internal control department, and often just one person handles payments.

Why four eyes work

The principle protects against two things at once.

Mistakes. An extra zero, the wrong supplier, an invoice that was already paid. When you entered something yourself, it’s easy to read straight past the error. A second person looks with fresh eyes.

Misuse and fraud. If one person can create and approve a payment on their own, nobody notices when it goes wrong. That applies to fraud from the inside, but more often to fraud from the outside: a scammer posing as a supplier or director has a much harder time when there’s always a second person in the loop.

In the internal control literature this is called segregation of duties: creating, approving and executing sit with different people. The four-eyes principle is its lightest form.

Where to use it

Not everything needs two people. That slows things down and people start working around it. Pick the actions where a mistake is expensive or hard to reverse:

Payments above a threshold, for example anything over €5,000 or €10,000.
Payments to a new or changed bank account, regardless of the amount. This is the classic entry point for invoice fraud.
Changes to master data, such as a supplier’s new bank details in your accounting system.
Orders and contracts above a threshold, especially with suppliers you have no agreements with yet.
Credit notes and discounts above a set amount.
Admin rights in systems, such as a new global admin in Microsoft 365.

Choosing thresholds

A common mistake is one threshold for everything. A €2,000 payment to your regular energy supplier is not the same as €2,000 to a new overseas supplier. A few clear rules work better:

A threshold per type of action (ordering, paying, crediting).
Always four eyes for anything new: a new supplier, new bank details, a new country.
A second, higher threshold above which management signs off.

Write the thresholds down and tell everyone who deals with them. A threshold only the finance manager knows about doesn’t work.

When there’s only one person in finance

In many small companies one person runs all the bookkeeping. Four eyes then seems impossible, but there are ways:

The owner or director approves, for instance through the second signature most business banks offer.
Your accountant or bookkeeping firm checks payments above the threshold or to changed bank details.
Split preparing and sending. The bookkeeper prepares payments, the director sends them.

The point isn’t that the second person recalculates everything. It’s that there’s a moment when someone else looks on purpose.

The biggest risk: rubber-stamping

The four-eyes principle rarely fails because it doesn’t exist. It fails because the second person doesn’t really look. By the fiftieth approval of the week, you click Approve without reading. A few things help:

Only require approval where it counts. Fewer approvals means better scrutiny.
Give the approver context. Amount, recipient, reason and the rule that applies. Without context you can’t judge.
Make it easy to say no. A rejection with a short note (“get a second quote first”) should be normal, not confrontational.
An approval covers one action. Not “this week’s orders”.
Never approve your own request. Not even when it’s busy.

Recording without red tape

You’ll want to see later who approved what: in a dispute with a supplier, when the auditor asks, or after an incident. An email saying “fine” in someone’s inbox is a poor record. Make sure approvals are captured in one place, with time and context.

The moment is everything

The best agreement doesn’t help if nobody thinks of it when it matters. An employee placing an urgent order on a Friday afternoon doesn’t look up the purchasing policy first. That’s why the four-eyes principle works best when it appears by itself: on the screen where the order or payment happens.

In short

Choose a limited number of actions where a second person signs off.
Use thresholds per type of action, and always four eyes for anything new.
Even with one person in finance it can work: with management, your accountant or a second signature.
Give approvers context and make rejecting normal.
Record approvals, and make sure the agreement shows up at the moment of action.

Want to see how that works in practice, including in online shops and portals that have no approval feature of their own? Read about the four-eyes principle with ClickCheck.