When dual control exists on paper only
Shared tokens, urgent overrides, and weekend releases can hollow out dual control without anyone rewriting the policy.
Every treasury policy we read in Hong Kong says dual control applies to payments above a threshold. Every payment desk we visit has a story about the Friday afternoon vendor who must be paid, the token holder who already left for the ferry, and the workaround that “won’t become habit.”
During floor reviews we watch for three tells:
- One hardware token known to two people. Custody looks fine in the register; practice is a drawer.
- Override logs that are empty. Either overrides never happen — unlikely — or they are not recorded.
- Weekend and holiday releases concentrated under a single operator with remote approval by chat screenshot.
None of these automatically equals fraud. They do mean the control the board believes is in force is thinner than the policy binder suggests.
Strengthening without freezing the desk
Document emergency-release criteria and require a next-business-day countersignature in the log. Split token custody so that the person who initiates cannot also hold the release credential. Sample weekend payments monthly — ten minutes for a controller, high signal for drift.
These themes often surface inside a broader treasury control review; they can also be the sole focus of a payment authority audit.