One system for the whole organisation.

Every journal move must balance before it commits. Fixed-point decimal at precision 19, scale 4 prevents rounding drift, and any validation failure reverses the whole entry rather than part of it.

Enforced in the data model, not by procedure: the requester is never the approver, the voucher creator is never its sole approver, and the approver is never the poster. The submitter cannot resolve as their own approver at any step.

The approval log is append-only. Every submission, approval, rejection and return is timestamped and attributed to the person who acted, and no row is ever updated or deleted.

Every endpoint requires authentication. Approver pools resolve through security groups, so only a member of the right group can ever act on a document. Session timeout and TLS in transit are specified.

Each document type follows one fixed, repeatable approval sequence. Steps cannot be reordered or skipped at run time — only an administrator can reconfigure them, and the change is recorded.

Sequential approval through supervisor, finance and director, with parallel quorum where a document needs several approvers at once — the finance manager and every project manager named on its lines.

Purchase order, goods received note and vendor invoice matched on quantity, price and vendor before payment, with tolerance-based variance handling and a mandatory finance manager override on any exception.

Availability on the expense account and the activity is checked before a document is submitted, not after it is approved. Accrual-based ledger, multi-period fiscal control and donor fund accounting are designed in.

Approval thresholds per step mirror a written delegation matrix — a director required only above a stated amount — and are configurable without a code change.