Duplicate invoices that look like new bills
A second vendor record with the same bank account can pass every payment approval and still be a control failure.
Payment runs judge the document in front of them: match status, amount, and a familiar supplier name. They rarely ask whether that name is the only record pointing at the same bank account.
In our duplicate-payment examinations we look for recycled invoice numbers, near-duplicate legal names, and bank-detail changes that never entered the dual-control queue. Those changes sit upstream of the approval you are proud of.
If master-data amendments can be completed by the same person who proposes payments, the later approval trail is decorating a decision that already happened.