Reading a dual-signatory matrix without wishful thinking

Most Hong Kong mid-market companies can produce a dual-signatory matrix. Fewer can show that yesterday’s payments obeyed it.

Look for thresholds that nobody remembers

Matrices often list four bands — under 10,000, under 50,000, under 200,000, and above — while the payment desk operates on two informal bands remembered from a previous CFO. During disbursement testing we compare the written grid to the last thirty bank exits, not to the training slide.

Check who actually held the token or chop

Where bank tokens or company chops sit with a single administrator, the second signature on paper may never have been in a position to refuse the payment. Interviews clarify custody better than org charts.

Temporary authorisers need end dates

Holiday cover that never expires becomes permanent authority. We ask for the memo that created the cover and the date it should have lapsed.

Matrices must name entities

Group matrices that ignore dormant subsidiaries create false comfort when those entities still hold operating accounts. Cash disbursement audit tracking starts by listing every account that moved money in the period — then asking which matrix applied.

If your matrix cannot survive that sequence, fix the document before the next statutory review asks the same questions under time pressure.