most employees shouldn't be able to touch the funds at all except a handful and probably require supervisor verification (dual factor authentication).