Payment Segregation of Duties (D2)

direction: right

req: Requisition {
  buyer: Buyer raises the requisition
  budget: Budget holder approves
}

proc: Procurement {
  po: Purchase order against a framework
  vendor: Vendor master maintenance
}

ap: Accounts payable {
  invoice: Invoice capture (three-way match)
  exception: Exception queue
}

pay: Payments {
  prep: Payment run prepared
  auth1: First authoriser (to 50k)
  auth2: Second authoriser (above 50k)
  bank: Bank host-to-host release
}

ctl: Controls {
  sod: Segregation of duties rule engine
  audit: Immutable audit trail
}

req.buyer -> req.budget
req.budget -> proc.po
proc.po -> ap.invoice
proc.vendor -> ap.invoice: bank details on file
ap.invoice -> ap.exception: price or quantity mismatch
ap.invoice -> pay.prep: matched and approved
pay.prep -> pay.auth1
pay.auth1 -> pay.bank: at or below 50k
pay.auth1 -> pay.auth2: above 50k only
pay.auth2 -> pay.bank
ctl.sod -> proc.vendor: payables staff cannot maintain vendors
ctl.sod -> pay.auth1: the preparer cannot authorise
ctl.sod -> pay.auth2: the two authorisers must differ
pay.bank -> ctl.audit
proc.vendor -> ctl.audit: bank detail change alert