It’s clear that there is a time and place for management to occasionally override a control. Everything in business is not routine, and there are times when special situations require special treatment. It would be silly to prohibit management from ever overriding the policies and procedures that are in place. There has to be guidance in place to direct employees when they may consider overriding controls.
However, it’s important to recognize that the override of controls should be the exception rather than the rule. Employees should be able to circumvent the system only on an infrequent basis, and these instances must be actively monitored to determine if the override process is being abused.
For example, there may be a policy specifying levels of approval before a payment can be issued. What if the person who normally approves the payment is on emergency sick leave and a payment needs to be made? There must be a process for getting an alternate employee to approve the payment. This transaction should then be flagged for later follow-up to determine that the payment was still proper. In this case, there is a need for overriding the normal control, but this is something that should happen infrequently.