The payment run has to go out by two o'clock, the person who holds the approval token is in a meeting, and the bank's cut-off will not move. So the token is handed across the desk, along with the PIN, "just this once". Everyone involved understands the risk. Everyone also understands that the alternative is a late salary. Within a few months, "just this once" is the way the workflow runs.
This piece looks at shortcuts that have become part of how finance and admin work gets done, why they are rarely a matter of carelessness, and what they cost the people carrying the risk. It is a hypothesis drawn from general research on workarounds, controls and workplace strain, not a finding about any particular South African employer.
Shortcuts that are built in
A workaround is a method for overcoming a problem or limitation in a system, usually one that bypasses the intended process. Workarounds are not inherently bad; they are often how real work survives imperfect tools. The difficulty begins when the workaround is the only way to meet the deadline, and when the unsafe step is not an accident but a requirement of the schedule.
Common examples in finance and admin include:
- Shared logins and tokens because the system licenses too few users or the approver is unavailable.
- Payment instructions confirmed by chat message or phone photo instead of through the system's own approval step.
- Spreadsheets of bank details emailed between staff because the accounting package cannot export them in the form the bank needs.
- Skipping a second check because the second person is out and the run cannot wait.
- Working through the night before month-end because the process allows no slack.
The earlier piece on when software workarounds replace professional discretion describes how this pattern changes the nature of skilled work. Here the focus is narrower: workarounds that put people and money at risk.
Why the risk lands on people
Segregation of duties is a long-standing control principle: no single person should be able to initiate, approve and conceal a transaction, so that errors and fraud are harder to commit and easier to catch. When a workflow forces staff to bend that principle in order to function, the control is gone, but the responsibility is not. If something goes wrong, the person who shared the token or skipped the second check is the one whose name is on it.
The UK Health and Safety Executive's management standards for work-related stress identify demands as a core area, including workload and the pace of work. A deadline that can only be met by an unsafe step is a demand with a hidden cost. The person pays it in vigilance: the low-level worry that this might be the time it goes wrong.
The World Health Organization's guidance on mental health at work lists unsafe working conditions, long or inflexible hours, and low control among the risks to mental health. Chronic exposure to a workflow one knows to be unsafe, without the authority to fix it, combines several of these at once. The strain is not dramatic. It builds quietly, over many ordinary weeks.
An illustrative case
Consider an illustrative example, not a real case: a Bloemfontein building supplies company with a two-person finance team. The bank requires two approvers for payments above a limit. One approver, the owner, travels to branches for much of the week. To keep suppliers paid, the bookkeeper has, over time, begun to use the owner's token and PIN, which he has shared by phone. The arrangement began during a week of repeated power cuts when the office internet kept dropping and the owner could not log in remotely.
It works, and nothing has gone wrong. But the bookkeeper now carries a private knowledge: if a payment were ever disputed, or if the bank asked questions, she would have to explain why she was acting as both approvers. She does not raise it, because the owner is under pressure and the suppliers are paid. She sleeps badly in the last week of each month.
The human tax: safety and wellbeing
The cost is borne in two forms. The first is exposure: the person holds personal liability for a control that the business has bypassed. The second is wellbeing: the steady, low-grade stress of knowing that the working method is unsafe and that fixing it is not in their gift. The business may see only the paid invoices and the on-time run.
There are legal threads too. The Protection of Personal Information Act (POPIA) requires responsible parties to secure the personal information they hold, and shared logins and emailed spreadsheets of bank details work against that. The Information Regulator publishes guidance on the Act. As with any legal question, a business with specific concerns should take advice instead of relying on a general article.
What could realistically change
The aim is not to forbid all workarounds, which would stop the work. It is to bring the unsafe ones into view and replace them with safe equivalents.
- Ask staff which steps they dislike doing. A short, no-blame conversation will surface the shortcuts quickly. The note on the team that only talks when something breaks explains why people need an invitation before they share these.
- Remove the reason for each shortcut. If the token is shared because the approver is away, arrange a named alternate approver with their own credentials. If a spreadsheet is emailed because of an export limit, fix the export or use a secure transfer.
- Build slack into the calendar. If the payment run can only succeed with no margin for delay, move it earlier. A deadline with a buffer is a safety measure. The piece on when payroll week means late nights for one person shows how thin schedules create the pressure to cut corners.
- Use individual credentials. Where a tool charges per user, weigh the cost against the exposure. The relief described in the relief of a password you don't have to reset is partly the relief of not having to share one.
- Give people authority to stop. Make it explicit that a staff member may delay a run rather than bypass a control, and that this will not be held against them.
The business outcome
A business that removes the need for unsafe shortcuts reduces its exposure to fraud, to payment errors and to awkward questions from banks or auditors. It also reduces the number of people who carry a private worry on its behalf. Controls that work in practice are easier to defend than controls that exist only on paper.
The human dividend
The dividend is predictability: the knowledge that the working method is sound, that the deadline can be met without breaking a rule, and that the person at the desk will not be the one who answers for a gap in the system. It will not remove every pressure from finance work, but it removes the particular pressure of having to be quietly unsafe in order to be on time.
The trade-offs
- Safe alternatives cost something. Extra licences, alternates and earlier deadlines take money, planning and sometimes a change of habit.
- Some payments will be late. If the safe route is slower, a few runs may miss a cut-off until the new rhythm settles.
- Controls can themselves become friction. An approval chain that is too heavy encourages new workarounds, as the piece on why approval chains make capable people wait describes.
- Small teams have limited options. With two staff, perfect separation of duties may not be possible, and compensating checks such as owner review of bank statements may be the realistic answer.
Why it matters
An unsafe shortcut that is built into the workflow transfers risk from the business to the individual, quietly and without anyone deciding that it should. Bringing it into view lets the business fix the system instead of relying on its people to stay lucky.
Sources and further reading
- Workaround - Wikipedia (last verified 10 October 2026)
- Separation of duties - Wikipedia (last verified 10 October 2026)
- Management Standards - Demands - HSE (last verified 10 October 2026)
- Mental health at work (last verified 10 October 2026)
Related Mellorca reading
- The Sleep Lost Over a System Nobody Else Understands
- The Physical Toll of Doing a Machine's Repetitive Work
- When Your Best Work Is Invisible Because It's Repair Work