An approval matrix that exists only in a shared drive and never matches the people who click Approve in practice is a common starting point. We ask for both the written matrix and a month of claim logs with approver identity fields intact.
We look for substitute approvers who sign above their band, managers approving their own travel, and amount thresholds that ignore entertainment categories with higher fraud exposure. These patterns rarely appear in a policy PDF alone.
Where branches use paper forms for petty cash and digital forms for travel, we treat the two streams as separate chains. Mixing them into one narrative hides where dual control actually breaks.
Only after the matrix is sketched do we open individual vouchers. That order keeps the review focused on control design, not only on whether a single receipt looks tidy.