Plain definition
Dual authorisation requires two authorised people to approve a defined action before it proceeds, commonly a high-value payment, change to a bank beneficiary, or unusual contract. It reduces reliance on one person or one compromised credential. The two approvals should be separate in authority and in the evidence each person examines.
Two clicks are not automatically a control. If both approvers simply confirm the same unreviewed summary, the second approval adds little. The design needs thresholds or transaction types, a rule for absence, a record of who approved what, and an escalation route when the evidence is incomplete.
Illustrative example
Suppose a finance manager prepares a payment batch for new equipment. Before release, the finance director checks the approved purchase order and goods-receipt record, while a second bank approver checks the beneficiary list against previously verified supplier details. The second approver sees that one account number has changed and returns the batch for an independent callback to the supplier’s previously verified contact.
The batch is not released until the change is confirmed or removed. The two approvals serve different purposes: one tests whether the company owes the payment, and the other tests whether it is going to the expected destination.
Dual authorisation complements segregation of duties and approval limits; it does not replace either one.
Why it matters
It makes a payment-fraud attempt harder to complete through one misleading document or one compromised account.
It gives management evidence that a high-risk decision received more than a ceremonial sign-off.
Practical consequence
Specify the transaction types and thresholds that need two approvals, and state what each approver must verify rather than naming approvers only.
Periodically inspect approval history, including emergency or absent-approver routes, and test whether a changed beneficiary can bypass the independent check.