The company still has a payment policy. What it may not have is a working fallback.
Who can verify the change? Who is allowed to approve the exception? Who can release the funds? If the normal verifier and approver are both unavailable, can someone step in without collapsing two separate controls into one person?
Those questions matter because payment controls do not fail only when someone ignores the rules. They can also fail when the people who make the rules work are absent, and the organization has not designed a safe substitute.
Year-end leave makes that problem easier to expose, but it is not uniquely seasonal. The same weakness can appear during illness, travel, executive transitions, parental leave, unexpected departures or any period when a named decision-maker cannot be reached.
For founders, finance leaders and operators, the practical task is therefore to test authorization continuity before the absence begins. The business should know who can request, verify, approve, release and escalate a material payment when the usual people are unavailable—and which duties must remain separated even under pressure.
Most businesses do not describe their payment process as “dependent on the CFO.”
On paper, they may have approval limits, dual authorization, vendor onboarding rules and controls for changing bank details. In practice, however, one named person may still be the person everyone calls when something unusual happens.
That dependency can remain invisible until the person is unavailable.
A routine payment may simply wait. A supplier may chase for settlement. A deal may be approaching a completion date. Payroll, tax, insurance, inventory, professional fees or a contractual milestone may be time-sensitive. Someone asks whether another director can approve it “just this once.”
That is the point at which a temporary operational problem can become a control problem.
If the substitute approver does not have the required authority, the payment may be delayed. If the substitute is granted too much access, separation of duties may disappear. If the business cannot independently verify a changed bank account because the normal supplier contact is also away, a legitimate payment may become harder to distinguish from an impersonation attempt.
The danger is therefore broader than fraud. Poor authorization continuity can produce:
The common issue is not simply absence. It is the difference between a person being unavailable and the control becoming unavailable with them.
A useful year-end review should map the payment process by function rather than by seniority.
For a material payment, the business may need several different jobs to happen:
The same person does not necessarily need to perform each role.
In fact, good control design often depends on keeping incompatible responsibilities apart.
The U.S. Government Accountability Office's 2025 Green Book says incompatible duties should be segregated and, when segregation is not practical, management should design alternative controls. For payment governance, that is the more direct principle: key responsibilities should not quietly collapse into one person because staffing changes.
NIST SP 800-53 Rev. 5 supports the same control logic from the access-control side. Its separation-of-duties control calls for identifying duties that must remain separate and defining access authorizations accordingly.
The GAO Green Book sets federal internal-control standards, while NIST SP 800-53 is a security and privacy control catalog. Neither is a private-sector payment mandate; both are useful control-design references.
For a lean startup, the practical point is simple: if ideal separation is not possible, decide in advance what secondary review, lower limit, independent check or documented oversight will compensate.
The most obvious response to an absent approver is to delegate authority.
That may be entirely appropriate.
The risk appears when the temporary arrangement gives one person responsibilities that are normally separated.
For example, a finance manager who ordinarily prepares payment files might also be given temporary approval rights while the CFO is away. If that same person can now create a new payee, change bank details, approve the invoice and release the payment, the business has not merely replaced an absent approver. It has redesigned the control environment—possibly without realizing it.
A stronger delegation plan answers several questions before leave begins:
The goal is not to make every payment harder. It is to prevent a short-term staffing arrangement from quietly giving one person end-to-end control over a transaction that would normally require independent checks.
That includes access. Temporary authority should use named accounts, documented roles and time-bounded permissions rather than shared passwords or an absent director's login. Access continuity should preserve accountability as well as availability.
Requests to change supplier banking information deserve special treatment because a legitimate-looking request can still be fraudulent.
The FBI's current Business Email Compromise guidance tells businesses to verify payment and purchase requests and to verify changes in account numbers or payment procedures with the person making the request. It also warns against acting quickly simply because the requester is applying pressure.
The Internet Crime Complaint Center similarly recommends using a secondary channel or two-factor verification for account-information changes.
That principle should survive staff absence.
If the normal accounts-payable contact is away, the fallback should not be “reply to the email and ask whether the change is correct.” If the email itself has been compromised, the business is still relying on the channel under suspicion.
A known telephone number already held in supplier records, an established portal, a verified alternate contact or another trusted route is stronger than using contact details supplied in the same message that requested the change.
The control is familiar from funding-round fraud: new payees and bank-detail changes should be independently verified before money is released. The additional question here is continuity.
Who performs that verification when the person who normally does it is away?
If the company has no answer, the underlying control exists only during normal staffing.
Controls are most likely to be tested when someone says the transaction cannot wait.
The supplier needs payment today. A completion date has moved. An executive says the delay will damage the relationship. Someone is traveling. The ordinary approver is unreachable.
That is precisely when the fallback process should become more structured, not less.
A practical exception route can define:
The distinction matters because urgency is a business condition, not an authorization method.
A transaction can be urgent and still require independent verification.
A useful policy therefore avoids vague wording such as “a director may approve in exceptional circumstances” unless the business also defines what that approval means, what evidence is required and what the director cannot override.
Year-end continuity plans often focus on whether someone can respond if a system fails.
That is important, but it solves a different problem.
A managed IT provider may monitor infrastructure, secure an account, help restore access or investigate suspicious activity. That does not make the provider an authorized finance approver.
The distinction is visible in the wider question of after-hours business continuity. Technical support is useful only when the organization also knows who has authority to make the business decisions that follow an alert.
The same principle applies to payments.
A company using technology services by SAM IT, for example, may have access to the provider's published 24/7 helpdesk, monitoring, troubleshooting and security support. That can help when the issue is technical. It does not answer whether a supplier bank-detail change is commercially valid or who inside the client company can authorize a transfer.
That boundary should be explicit before a high-pressure request arrives.
Outside technical coverage can help keep the environment available. The internal authorization chain remains a management responsibility.
A year-end authorization plan should be tested against a realistic transaction before key people leave.
The test does not need to move real money.
It can use a representative scenario:
A known supplier emails to say its bank details have changed. A $75,000 payment is due tomorrow. The usual verifier is away. The CFO is abroad. The first-choice substitute is available, but that person also prepared the invoice for payment.
The business should then work through the process exactly as it would in practice.
The test should expose ambiguity before the real transaction does.
A useful result is not simply “the payment could be processed.”
The stronger result is: “the payment could be processed without removing the controls that made it safe.”
Before planned absences begin, management can perform a short control review.
An external technical assessment can help expose dependencies around access, systems and support. Rose Computer Technology Services, for example, publishes cybersecurity and technology-management services including risk assessment. That can inform the technical side of the review; it does not determine who should hold financial authority.
This is not a recommendation to create a second payment process for December.
The objective is the opposite: make sure the normal control principles remain usable when the normal people are not.
Good control design should also include the failure path.
If a payment is sent to the wrong account, speed matters.
IC3 advises businesses that discover a fraudulent transfer to contact their financial institution immediately and request a recall, then report the incident to IC3 as soon as possible.
The company should therefore know in advance:
This is another reason authorization continuity is broader than prevention.
The company also needs continuity in its response authority after something has gone wrong.
Year-end leave is a useful trigger because absences are often known in advance, but the control should not expire in January. A company can have a well-designed payment policy and still discover that it cannot operate it when one person is away.
That is the central year-end test.
The strongest organizations do not respond by weakening controls whenever normal staffing changes. They decide in advance who has substitute authority, preserve incompatible duties, maintain independent verification and document how urgent exceptions will be handled.
Technical coverage can keep systems running. It cannot decide who is authorized to move the money.
The payment-control chain should therefore be tested in the same way the company tests any other continuity dependency: under the conditions in which it is most likely to fail. Revisit the fallback when approval limits, banking systems, finance roles, supplier relationships or transaction values change.
If the usual approver is unavailable tomorrow, the business should already know what happens next.
Not if doing so collapses duties that are normally separated. A temporary approver can be appropriate, but the business should preserve independent checks or use compensating controls such as additional review, lower limits, documented exceptions or post-transaction oversight.
The change should still be independently verified through a trusted channel. Do not rely only on the email or contact information supplied in the change request. The fallback plan should identify who performs that verification during planned absences.
Not merely because it is the IT provider. Technical support and financial authorization are different responsibilities. A provider may help secure systems, investigate suspicious messages or restore access, but the business should define which internal personnel can validate the commercial request and approve the transaction.
The business should use a documented exception process that defines who can approve the exception, which controls remain mandatory, any temporary limits and how the decision is recorded. Urgency should not itself become permission to bypass independent verification.
At minimum, they should be reviewed before significant planned absences and whenever the organization changes approval roles, payment systems, banking arrangements, transaction values or business structure. The test should confirm that a realistic payment can move through the fallback chain without removing key controls.