Alderway runs residential care homes across Flanders. Four hundred and thirty people, five of them in finance, and an external auditor who had raised the same finding two years running.
The situation
The finding was segregation of duties, and it was correct. On a team of five, the person who set up a supplier was frequently the person who paid it, not out of carelessness but out of arithmetic — somebody was on leave, somebody else was covering two sites, and the payment had to go out on Thursday.
- A shared bank login, because individual credentials had not been practical.
- An expense tool where the administrator was also an ordinary claimant.
- A manual approval log, completed after the fact, from memory.
The standard answer to this finding is to hire. Alderway had costed it: two roles, neither of which would be busy, in a sector where every euro of overhead is a euro not spent on care. The board had declined twice and the finding had stayed open twice.
The change
The controls moved into the rules. Initiating a payment, approving it and releasing it are three distinct permissions, and no person holds a combination that lets them complete a payment alone — including the finance director, which was the detail that satisfied the auditor.
The part that made it workable on a team of five is that the rules cover absence. If the ordinary approver is away, the fallback is defined in advance rather than improvised, so nobody has to choose between the control and the Thursday deadline.
Every previous answer to this finding started with hiring somebody. The answer was to write down what we already meant and let the system hold us to it.
Iris Bakker · Finance Director, Alderway
The outcome
The finding closed six weeks after the project started, and it has not been raised since.
There are no shared credentials. Every payment carries two named people, and the finance team is still five. The auditor’s note the following year records the control as effective, which is a sentence Alderway had been trying to get written for three years.
