Rubber Stamping Nonsense - When Approval Isn't Really Oversight

Every organisation has approval processes.

Timesheets are approved. Leave is approved. Procurement requests are approved. Corporate credit card transactions are approved. Travel claims are approved. Invoices are approved.

Ask an executive whether appropriate controls exist and they'll often point to these approval processes as evidence that they do.

But here's the uncomfortable reality.

An approval is only a control if the person approving something is both willing and able to determine whether it is legitimate.

Too often, approvals are nothing more than administrative theatre.

The Illusion of Control

One of the most common findings emerging from corruption investigations, fraud examinations and governance reviews is that organisations rely heavily on approvals that provide little or no real assurance.

The form gets signed.

The electronic workflow is completed.

The system records that someone approved it.

Everyone assumes the control worked.

Yet no one actually verified whether the transaction should have occurred in the first place.

The organisation has created the appearance of oversight while achieving very little.

The Impossible Approval

Sometimes the failure isn't the fault of the approver.

The process itself asks people to approve matters they could never realistically verify.

In a review of SA Health, it was uncovered that managers were expected to certify staff timesheets despite having no practical way of knowing whether the hours worked or allowances claimed were accurate. Claims were rarely audited, meaning the approval signature carried little real value.[1]

In the same organisation, finance staff were responsible for approving invoices payable to one of their own senior managers. Those officers reported directly to the manager whose expenses they were approving. Expecting a subordinate employee to objectively challenge their own boss is not a control - it is an impossible position.[2]

Similarly, a New South Wales ICAC investigation of an Immigrant Women’s Health Service, uncovered a CEO deliberately removed the supplier details from receipts before submitting them for reimbursement. The person processing the claim simply could not determine whether the purchases were work-related because the critical information had been deliberately removed.[3]

The approval process was never capable of preventing fraud or misconduct.

"I Just Signed It"

Perhaps the most revealing evidence comes from the admissions made by approving managers themselves.

Across numerous investigations, approvers have openly acknowledged that they simply trusted the employee, assumed everything was in order, or believed their role was merely to sign the paperwork.

A manager at Inner West Council admitted he could not recall ever rejecting a procurement recommendation and that the approval was largely a ‘rubber stamp’.[4]

Another manager working at NSW Roads and Maritime Services described his role as essentially placing his signature on documents, checking only that they ‘made sense’.[5]

A finance manager at Gandangara Local Aboriginal Land Council approved a CEO's expense claims simply because she trusted him. That unquestioning trust allowed duplicate claims and substantial personal expenditure to be reimbursed over an extended period.[6]

Another senior executive from Warrnambool City Council admitted he simply "signed the damn thing" because he was busy and trusted the employee.[7]

These aren't isolated failures by careless individuals.

They expose a deeper organisational culture where approval has become an administrative exercise rather than a genuine safeguard.

Clever People Know How to Beat Weak Controls

Those intent on misconduct rarely submit obviously fraudulent claims.

They understand the approval process.

They know what the approver expects to see.

In one local government investigation, large alcohol bills were disguised as "room hire" on receipts.

The approving manager accepted the description at face value without further inquiry.[8]

In another case, a school employee omitted key information from purchasing records, including invoice details and explanations for the expenditure. The principal approved the transactions in bulk at month's end without noticing the missing information.[9]

When approvals become routine, people stop asking questions.

That is exactly what dishonest employees rely upon.

The Worst Control of All

The most dangerous approval process is one where the person committing the misconduct controls the approval itself.

One council chief financial officer was responsible for approving corporate credit card expenses, including his own. The official cardholder never even saw the statements.

The result was entirely predictable.

Hundreds of thousands of dollars were misappropriated while the organisation continued to believe its approval process was functioning as intended.[10]

An approval process that allows individuals to authorise their own expenditure is not a control.

It is an invitation.

The Questions Every Board and Executive Should Ask

When reviewing governance arrangements, organisations often ask: "Do we have an approval process?"

The better questions are:

• Does the approver have enough information to determine whether the transaction is legitimate?

• Does the approver have the independence to challenge it?

• Do they have the authority to refuse it?

• Are they expected to verify anything, or simply process paperwork?

• What evidence demonstrates that approvals are actually scrutinised rather than routinely accepted?

  
  

If the answer to these questions is "no", the approval process is providing little more than false comfort.

Governance Is About Challenge, Not Signatures

Good governance is not measured by how many approvals exist.

It is measured by whether those approvals meaningfully reduce risk.

Effective controls require independent scrutiny, sufficient information, appropriate authority and a culture where asking difficult questions is expected - not discouraged.

Otherwise, organisations are left with what many corruption investigations have repeatedly exposed:

A collection of signatures.

A completed workflow.

And the illusion that someone was watching.

Ask the questions now – and if you need help call us.

#Governance #CorporateGovernance #Integrity #RiskManagement #FraudPrevention #InternalControls #Leadership #LiftStrategic

[1] Troubling Ambiguity, Independent Commissioner Against Corruption SA, 2019, page 28.

[2]  Troubling Ambiguity, Independent Commissioner Against Corruption SA, 2019, page 18.

[3] Investigation into the Conduct of a Principal Officer of two non-government organisations and others, Independent Commission Against Corruption NSW, 2018, page 18.

[4]  Investigation into the Awarding of Transport for NSW and Inner West Council Contracts, Independent Commission Against Corruption NSW, 2024, page 157.

[5]  Investigation into the Awarding of Roads and Maritime Services Contracts, Independent Commission Against Corruption NSW, 2023, page 173.

[6]  Investigation into the Conduct of Former Chief Executive Officer and Members of the Board of the Gandangara Local Aboriginal Land Council, Independent Commission Against Corruption NSW, 2017, pages 35-37.

[7]  Investigation into corporate credit card misuse at Warrnambool City Counil, Victorian Ombudsman, 2020, paragraph 136 (2).

[8]  Investigation into corporate credit card misuse at Warrnambool City Counil, Victorian Ombudsman, 2020, foreword.

[9]  Misconduct in public organisations: A casebook, Victorian Ombudsman 2023, page 22.

[10]  Investigation into the conduct of the former city of Botany Bay Council Chief Financial Office and others, Independent Commission Against Corruption, 2017 page 62.