The four-eyes principle requires that a significant action is checked or approved by a second, independent person before it takes effect. In finance it applies to payments, manual journals, changes to supplier bank details and access rights, so one person's error or fraud cannot go through alone.
What is the four-eyes principle?
Four eyes means two people: one prepares, the other reviews and approves. The second person must be independent of the first and must actually check, not just click. The rule underneath is simple: nobody approves their own work.
It is a specific use of segregation of duties. Segregation splits whole processes between roles; the four-eyes principle puts a second person on a single high-risk step. The delegation of authority says who that second person must be.
Where does the four-eyes principle apply in finance?
| Action | First pair of eyes | Second pair of eyes |
|---|---|---|
| Releasing a payment run | Payables accountant | Finance manager or CFO, within their limit |
| Changing supplier bank details | Person entering the change | A second person who verifies it with the supplier |
| Posting a manual journal | Preparer | Reviewer with authority for the amount |
| Granting system access | Requester or administrator | Owner of the process |
| Writing off a receivable | Credit controller | Approver under the delegation of authority |
The strongest checks use independent evidence. To verify new bank details, call the supplier on a number already on file, not the number in the email asking for the change.
What does the four-eyes principle look like in practice?
Why does the four-eyes principle matter?
It catches mistakes, such as a misplaced digit in an amount, and makes fraud harder because it needs two people to agree. It also leaves a record for the auditors: who prepared, who approved and when.
It fails when it becomes a formality. Watch for approvers who approve everything within minutes, the same pair always approving each other, and "urgent" requests that skip the second check. Keep every approval in an audit trail that cannot be edited.
Questions people ask
Is the four-eyes principle a legal requirement?
For most companies it is an internal control rather than a specific legal rule, set out in the delegation of authority and expected by auditors. Regulated businesses should check what their regulator requires.
Can the same two people always check each other?
They can, but rotating the checker where possible reduces the risk of two people agreeing to bypass the control, and of checks becoming routine.
Does the four-eyes principle slow the finance team down?
A little, on the actions it covers. Apply it where the risk justifies it, such as payments, bank details, large journals and access, and set amount thresholds so routine low-value items move faster.