Four-Eyes Principle (P2P)Control and Compliance in the Purchase-to-Pay Process
Procurement glossary · Updated · 7 min read
Also known as: Four-Eyes-Principle, 4-Augen-Prinzip, 4EA, Vier-Augen-Kontrolle, Dual Control
Short answer
- The four-eyes principle requires that orders and invoices are reviewed and approved independently by at least two people.
- In the P2P process, it mainly affects purchase order creation, purchase order approval, goods receipt and invoice verification.
- Approval thresholds, clear roles and digital workflows make it efficient and audit-proof.
In the context of Purchase-to-Pay (P2P), the four-eyes principle is an organisational principle under which critical steps in the ordering and invoicing process are reviewed and approved by at least two people independently of one another. It serves to prevent errors, prevent fraud and ensure the traceability of procurement decisions. In practice, it mainly affects purchase order creation, purchase order approval, goods receipt and invoice verification. For technical buyers, it is a key control instrument for keeping processes secure yet efficient.
Key facts
- The four-eyes principle requires the independent review of a transaction by at least two people, typically the creator and the approver.
- In the P2P process, it mainly affects purchase order creation, purchase order approval, goods receipt and invoice posting.
- Approval thresholds frequently tier the review effort by order value, budget relevance or supplier risk.
- Digital workflows in ERP or e-procurement systems document approvals in an audit-proof and automatic manner.
- Excessive control slows down the procurement process; approval levels should be limited on a risk-based basis.
Contents
- Definition: the four-eyes principle in the P2P context
- Methods and approach: implementation in the procurement process
- Key KPIs: measurability of approval processes
- Risks and controls: typical weak points
- Current developments: digitalisation and automation
- Typical metrics
- Practical example
- Conclusion
- Frequently asked questions
Definition: the four-eyes principle in the P2P context
The four-eyes principle (German: Vier-Augen-Prinzip, also 4EA) describes the rule that transactions of economic or legal relevance may not be initiated, reviewed and approved by a single person alone. In the Purchase-to-Pay process, this means: requisition, ordering, goods receipt and invoice processing are controlled by at least two participants who judge independently of one another.
Distinction from transaction control
The principle differs from mere sequence control, where several people process the same transaction one after the other. What is decisive is substantive independence: the approver does not merely check formally whether fields have been completed, but assesses economic merit, budget coverage and, where applicable, price reasonableness. This creates a second, independent perspective on the same matter.
Legal and audit background
In Germany, a statutory obligation to apply the four-eyes principle exists only in a few areas, for example at credit institutions. For industrial companies, the practical requirement arises primarily from corporate law, internal control systems and auditor expectations (e.g. in the context of statutory audits or ISO certifications). The concrete design should be coordinated on a case-by-case basis with internal auditors, tax advisors or compliance officers.
Methods and approach: implementation in the procurement process
Implementation follows a recurring pattern: define the objects of approval, set thresholds, determine roles and delegation rules, and map the workflow technically. Central to this is the clear separation of function and control – whoever creates a purchase order may generally not approve it themselves.
Approval levels and thresholds
In practice, companies typically tier approvals by order value: smaller amounts by the direct line manager, medium amounts by department or cost centre managers, high amounts by the management board or procurement. Non-monetary criteria such as new suppliers, custom-made items or circumvention of framework agreements can also trigger an additional approval. Too many levels slow down the process; limiting it to two to three levels often proves successful.
Role model and delegation rules
A functioning four-eyes principle requires clear roles: requisitioner, orderer, approvers, goods receipt and invoice verifiers must be recorded in the system. Delegation rules govern who approves during absences – without authorisations being lost through informal third-party delegation. Regular permission audits prevent unwanted powers of authority from accumulating over the years.
Exceptions and consolidated orders
For urgent material, spare parts in ongoing operations or emergency repairs, accelerated routes are required. Common approaches are simplified approval routes with subsequent review, defined exception catalogues or low-value orders with blanket approval. It is important that exceptions are also documented and checked on a sample basis.
Key KPIs: measurability of approval processes
Whether the four-eyes principle is genuinely practised and what costs it incurs can be measured using metrics from the P2P system. The decisive factor is the combination of cycle time, exception rate and control quality.
Cycle and processing times
The purchase order approval time from creation to transmission to the supplier is the core metric. In practice, average approval times often range from a few hours to several days; depending on the sector and approval levels, target values of one to two working days are aimed for. Long waiting times frequently create pressure to place orders around the approval process.
Exception and return rates
The rate of approvals chased retrospectively, rejected orders or queries from approvers shows how well requests are prepared. High return rates indicate unclear requirements or missing advance information. Monitoring deadlines for open approvals and evaluating orders by approval threshold are also part of standard reporting.
Completeness and compliance metrics
The share of purchase orders with a complete approval history, the share of subsequent orders (backorders after goods receipt) and sampling rates in invoice verification show whether the principle is actually effective. In addition, spend analysis and the ABC-XYZ analysis provide indications of which order volumes are particularly worth protecting and where approvals are particularly worthwhile.
Risks and controls: typical weak points
The four-eyes principle loses its effect when it is fulfilled formally but hollowed out in substance. Typical risks are pro-forma approvals, glance approvals within seconds and circumvention via direct orders or account budgets.
Pro-forma approvals and habituation effects
Anyone who receives dozens of approvals every day will eventually review them superficially. Reduced approval workloads help: only relevant orders land in the inbox, supported by clear advance information such as a cost breakdown, volume tiers or budget reference. Scoring matrices and defined review criteria help approvers decide in a structured manner.
Circumvention via purchase requisitions and catalogues
Backdoor processes arise when employees procure services via travel and expense accounts, workshop supplies or internal cross-charging. An effective control system therefore also monitors these secondary channels. Catalogue content management and standardised ordering catalogues reduce the approval effort for standard items and channel volume back into controlled channels.
Collusion and fraudulent constellations
Two participants can collude; the four-eyes principle does not fully protect against this. In addition, segregation of duties, rotation in key functions, right-to-audit clauses in supplier contracts and whistleblowing systems act as early warning indicators of irregularities. Regular data analyses for anomalies – such as frequent splitting just below thresholds – are a proven audit instrument.
Supplier-related controls
Four eyes are also needed on the supplier side: creation of new supplier master records, bank account changes and VAT ID verification should be confirmed by a second person. Otherwise, fraudsters open up payment risks – rather than ordering risks – via altered account details. Tier-n transparency and supplier ratings such as delivery performance complement the risk picture beyond the direct supplier relationship.
Current developments: digitalisation and automation
Digital P2P systems have developed the four-eyes principle from paper-based sign-off into automated workflow. At the same time, demands for traceability, sustainability and fraud prevention are growing.
Workflows, mobile approvals and automation
Modern ERP and e-procurement systems control approvals on a rule-based basis, document every decision in an audit-proof manner and enable mobile approvals. Routine repeat orders, Kanban-replenished demand or orders derived from the ABC-XYZ analysis can be approved partially automatically, so that manual four-eyes capacity remains available for strategically relevant transactions. Capacity planning in the procurement team helps distribute approval workloads realistically.
AI-supported review and fraud detection
Initial approaches use algorithms to detect anomalies in order and invoice data: atypical prices, duplications, anomalies in supplier patterns. Such systems do not replace the four-eyes principle but prioritise it – approvers only see the critical cases. Final responsibility remains with humans; decisions must remain documentable and explainable.
Compliance, sustainability and the supply chain
Approval processes are increasingly also becoming a control point for sustainability and supply chain requirements: supplier shifts, new sources or volume changes are reviewed with regard to the supply chain carbon footprint (SCF) and supply base optimisation. The four-eyes step thus evolves from a pure cost control instrument to the governance interface of overall procurement risk management.
Typical metrics
| Metric | Benchmark | Context |
|---|---|---|
| Purchase order approval time | 1–2 working days | Time from purchase order creation to approval; typical target value in practice |
| Share of approved purchase orders | > 99 % | Share of purchase orders with a complete approval history |
| Exception rate | < 5 % | Share of purchase orders chased retrospectively or placed outside the workflow |
| Backorder rate | < 2 % | Share of purchase orders not recorded until after goods receipt |
| Invoice verification sampling rate | 5–10 % | Usual sample size for automated verification |
Typical practical benchmarks – they vary by industry, part and contract.
Practical example
A mid-sized mechanical engineering company with around 350 employees suffered from approval times of up to a week; urgent orders were increasingly placed around the workflow. The company introduced a multi-level model with value thresholds, equipped all approvers with mobile approvals and automated repeat orders for A-items identified through the ABC-XYZ analysis.
- Approval levels reduced to three: up to €5,000 by the line manager, up to €50,000 by the departmental head, above that by the management board.
- All supplier master data and bank account changes have since been subject to a separate four-eyes approval including VAT ID verification.
- Monthly reporting on approval times, exception rates and backorders as early warning indicators.
- Sample checks of low-value orders by procurement to uncover circumventions.
Conclusion
In the Purchase-to-Pay process, the four-eyes principle is the foundation of control integrity, fraud prevention and audit-proof procurement. It only works if approvals are substantively independent, tiered on a risk basis and properly documented technically. At the same time, it must not paralyse the procurement process: thresholds, exception routes and automation must be balanced so that control and speed remain in equilibrium. Those who consistently link approval workflow, role model and KPI reporting reduce both error risk and process costs. This keeps the principle a central element of professional procurement governance in industry.
Frequently asked questions
What does the four-eyes principle mean in procurement?
It means that critical steps such as purchase order creation, purchase order approval and invoice verification are reviewed by at least two people independently of one another. This makes errors and abuse more difficult and ensures decisions are documented in a traceable manner. Within the P2P process, it forms the foundation of internal controls.
Is the four-eyes principle required by law?
In Germany, a general statutory obligation exists only in special sectors such as banking. For industrial companies, the requirement arises primarily from corporate law, internal control systems and auditor expectations. The concrete design should be clarified on a case-by-case basis with internal auditors or consultants.
How should approval thresholds be implemented sensibly?
A proven approach is to tier approvals by order value and risk criteria such as new suppliers or custom-made items. In practice, two to three approval levels are often sufficient to balance control and speed. Clear delegation rules and regular reviews of authorisations are essential.
Which steps in the P2P process require four eyes?
Typically these are purchase requisition, purchase order approval, goods receipt and invoice verification. In addition, supplier master data and bank account changes should be confirmed by a second person. Exception catalogues and low-value orders should also be checked on a sample basis.
How can pro-forma approvals be prevented?
By ensuring that approvers only receive relevant transactions and are supported with structured information such as a cost breakdown or budget reference. Mobile approvals, clear review criteria and a limit on the number of levels increase the depth of review. Sample checks and data analyses reveal whether approvals are actually performed with substance.
What is the difference from the six-eyes principle?
Under the six-eyes principle, three people review independently of one another, for example for particularly sensitive or high-value transactions such as capital goods or board-level matters. It increases the density of control but costs more time. Many companies therefore combine the four-eyes principle as the standard with six eyes for defined high-risk cases.
