Controls
Approvals without an audit trail are theatre
Most organisations already “have approvals”. Someone is copied. Someone replies “ok”. The problem is not culture. It is that the yes is not attached to the record an auditor will open. Six months later you can prove a conversation happened. You cannot prove which version of the purchase order it applied to.
A real control is boring: the request, the document, the role that must sign, and the timestamp live together. Customer Flow puts that on the file — shipments, grants, production, or campus purchasing. Permissions decide who can pass a stage. The trail is not a screenshot of a chat.
Put the yes on the file
NGOs feel this when a donor asks how a restricted line was spent. Universities feel it when internal audit samples a vendor payment. Manufacturers feel it when a substitute part entered the BOM on a verbal instruction. In each case the work was approved. The evidence was not on the file.
You do not need a six-month “governance programme” to start. Pick one process that already embarrasses you, run it in a workspace for the trial month, and keep email for conversation — not for the official yes.