What are common mistakes with Dual Authorisation?

Where Dual Authorisation breaks down in practice

dual authorisation fails most often when the process exists on paper but not in execution. The two approvals become sequential rubber stamps, the same operator can route both steps, or the workflow leaves gaps before, after, or around the approval point. Those gaps matter because the control is only as strong as the independence of the reviewers and the completeness of the workflow.

Another common mistake is treating Dual Authorisation as a check on only the final transaction while adjacent actions remain unrestricted. If account changes, limit changes, exception handling, or release steps are not covered, an attacker or insider can reshape the request so the “approved” action is no longer the meaningful risk point.

Dual Authorisation is easiest to erode when organisations rely on role names rather than actual separation of duties. The strongest controls are built around independent decision-making, clear audit evidence, and workflow design that prevents one person from preparing, approving, and executing the same sensitive action.

How to recognise a weak Dual Authorisation design

A weak design usually shows up as approval theater: both approvers work in the same chain of command, approvers can edit the request after the first approval, or the system does not preserve a reliable timestamped trail. If the control cannot prove who approved what, when they approved it, and whether the request changed in between, it is not dependable for high-impact actions.

It is also weak when exception handling is informal. Teams often create manual overrides for urgent changes, but if those exceptions do not have the same independence, logging, and review as the normal path, they become the easiest route around the control.

In practice, the right test is not whether the workflow has two buttons. It is whether the process still enforces independent review when users are under time pressure, when the request is being escalated, and when an operator has an incentive to bypass policy.

What good Dual Authorisation looks like

Good Dual Authorisation separates people, permissions, and evidence. The approvers should be independent, the system should block self-approval and same-path approval, and the record should show the full decision history, including request contents and any edits that occurred before final approval.

The control should also be aligned to the whole transaction path, not just a single action. In Segregation of Duties (SoD) Guide, the practical issue is how to prevent toxic combinations from being created by workflow design, not only by policy wording. That means mapping which steps must remain independent and checking for ways users can recombine them in practice.

Where the decision itself is about access or privilege, the approval logic should fit the underlying Authorisation Models Guide so that the request is evaluated consistently, with least privilege and policy enforcement tied to the real business event. That reduces the chance that dual approval becomes a superficial gate over a badly modelled entitlement change.

Risk and Threat Considerations

Weak Dual Authorisation creates a classic control-failure path: one person can effectively act alone, or an insider can influence the second approver into clicking through without genuine review. The result is not just policy non-compliance, but an easier route for fraudulent, excessive, or unauthorised changes to slip past controls.

Failure mechanism: The workflow permits shared control, undocumented overrides, or approval by a person who is not genuinely independent, so the second approval does not add real risk reduction.

Impact: Sensitive changes can be made with false assurance, and any later investigation may fail because the audit trail does not show a trustworthy decision sequence.

Practitioner Guidance

What to verify: Check whether the system prevents the requester from acting as either approver, whether edits after first approval force re-approval, and whether exception paths inherit the same control strength as the standard workflow.

Common mistake: Do not assume that dual sign-off alone equals separation of duties. If the same team, queue, or manager chain can approve both steps without meaningful independence, the control is much weaker than it appears.

Practitioner takeaway: Dual Authorisation is effective only when independence is enforced technically and procedurally, with a complete audit trail and no easy bypass around adjacent steps.

Related resources from NHI Mgmt Group

• What are the most common mistakes organisations make when launching green banking or telecom initiatives?
• What are the most common mistakes organizations make in a NIST SP 800-171 self-assessment?
• What are the most common mistakes teams make when implementing two-factor authentication for accounts?
• What are the most common mistakes teams make when hardening access to a cloud warehouse?