If the people authorized to approve payments authorize a $6,000 hammer, the payment system would be 100% correct to pay the vendor $6,000.

This is the blind spot that many owners of small businesses struggle with as they grow. Both Trump and Musk are people I'd put in that category (in spite of Tesla being a public company).

When you're small, the owner has a finger in everything. He (or she) is the one signing checks. The authorization system and the payment system are one and the same. The owner authorizes a payment by actually making a payment.

I've watched this happen in a previous life as the controller for a $20+ million in revenue business, and as the outside accountant for a couple others of similar size. Sure, there was Accounts Payable staff who went through the incoming bills, and entered them into the accounting system, then produced checks once or twice a week. Then the AP person takes a pile of checks with their supporting info and walks it across the courtyard to the President/CEO/Demi-god's office, where he looks over everything and signs the checks. Signing the checks is the only authorization for payment that happens.

But as a business grows large enough, those two processes eventually get separated. The CEO finally figures out that his time is better spent managing the rest of the business. So perhaps he'll give someone the authority to approve payments, and someone else the authority to make payments. So now he just looks at reports of payments authorized and payments made from time to time. Eventually that becomes the job of yet another person, and internal auditing is born.

--Peter