It's certainly something that should be rectified asap. The internal auditor is supposed to confirm this as part of the annual audit, but many do not. Standing orders are the framework within which we operate and, whilst they place many restrictions that some consider unwelcome, they are also our safety net. Without them, anything goes.