Finance should own the authorised signatory list and the compliance outcome, while IT should own the certificate workflow, access enforcement, and logging. The key is joint accountability for who can sign, which certificate is valid, and whether the audit trail is complete.
How finance and IT should split GST signing control ownership
The cleanest split is to separate business authority from technical enforcement. Finance should decide who is authorised to sign GST-related documents and own the compliance outcome. IT should implement the certificate lifecycle, access controls, and logging that make that decision enforceable and auditable. This avoids blurred accountability while keeping the signing process operationally reliable.
What finance owns versus what IT owns
Finance owns the policy question: which roles, individuals, or delegated officers may sign, under what conditions, and with what approval trail. That includes maintaining the authorised signatory list, reviewing changes, and confirming that the signatory arrangement still matches the tax and delegation requirements of the business.
IT owns the control mechanism: the certificate workflow, secure storage or issuance path, system access enforcement, and log retention. Where a signing certificate is used, IT should ensure it is issued only to the approved signer, tied to the correct environment or account, and revoked promptly when the signer changes or leaves. The business decision comes from finance, but the technical gatekeeping lives with IT.
Why shared responsibility works better than shared ambiguity
GST signing controls fail when one team assumes the other is checking authorisation. Finance usually knows who should be empowered to sign, but it may not see certificate expiry, key compromise, or account misconfiguration. IT usually controls the systems, but it may not know whether a technically valid certificate belongs to a currently authorised signatory. The control only works when both sides own their part of the chain.
That separation also makes audit evidence easier to produce. Finance can show the approval basis for the signatory list, while IT can show issuance records, access logs, and revocation history. Together, those records prove not just that a signature occurred, but that the right person or delegated identity signed with a valid certificate at the time.
Risk and Threat Considerations
GST signing controls create exposure when business authority and technical access drift apart. A signer may remain technically able to sign after their mandate has expired, or a valid certificate may be usable by someone who is no longer approved. That can create compliance failure, unauthorised filings, and weak non-repudiation if the audit trail does not clearly link authority to the signing action.
Failure mechanism: The control breaks when finance updates the signatory list but IT does not revoke or reissue the certificate, or when IT keeps access active without a current finance approval basis. A second failure mode is incomplete logging, which leaves no reliable evidence that the signer, certificate, and approval state matched at the time of signing.
Impact: The organisation may submit a filing with an invalid approval basis, struggle to defend the signature during audit, or be unable to prove who authorised and executed the transaction. In practice, that turns a routine signing step into a governance and evidentiary problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | GST signing certificates need controlled issuance, rotation, and revocation. |
| AU-2 — Event Logging | Signing controls require a complete audit trail for accountability and review. | |
| Recommendation — Manage signing certificates with issuance, renewal, revocation, and inventory controls. Log certificate use, approvals, and sign actions to preserve an audit trail. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Authorised signing requires policy-backed access restriction to approved signatories. |
| A.5.16 — Identity management | The signatory list depends on clear identity ownership and approved delegation. | |
| A.5.18 — Access rights | Certificate-enabled signing must be revoked when signatory authority changes. | |
| Recommendation — Define and enforce access rules for who may use signing credentials. Maintain authoritative identity records for approved signers and delegates. Review and revoke signing access rights when authority changes. | ||
Practitioner Guidance
What to prioritise: Treat the authorised signatory list and the certificate registry as linked control records, not separate admin tasks. If those records can diverge, the control is already weakened.
What to verify: Finance should verify named signatories and delegation changes; IT should verify certificate ownership, expiry, revocation, and log completeness. The control is only trustworthy when the current signatory list and current technical access state reconcile cleanly.
Decision rule: If a certificate can still sign, it must be covered by a current finance approval. If the approval has changed and the certificate has not, treat that as a control exception, not a minor admin delay.
Practitioner takeaway: The safest operating model is joint accountability with clear boundaries: finance decides who is allowed to sign, and IT proves the system will only let that approved signer do it, with evidence.
Related resources from NHI Mgmt Group
- Who is accountable for maintaining internal controls over financial reporting when security and finance teams share responsibility?
- Should IAM and fraud teams share responsibility for session trust controls?
- Should identity teams and finance teams share ownership of corporate account takeover controls?
- How should compliance and security teams share responsibility for e-skimming controls?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 13, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org