Would you say this is CYA by finance when forced to go public by those with a controlling interest in the company? Because it definitely has that CYA vibe.
IE, can the entire finance department sign off on checks? Or something along those lines.
But with the above example, say anyone can process process orders without any oversight (ie no sign off by 2 VPs or something like that) What is potentially stopping some AP clerk from setting up a fake company, and then paying them for services every month?
These are also the types of things that controls over financial reporting could mean.
Is it possible to have one without the other?
Just because an AP clerk could embezzle money that way, doesn't mean that they've identified evidence of that happening. But now they've reported that lapse in financial controls (which may or may not have been addressed), and warned that there may be others.