One person cannot do both halves

LEAT refuses when the same person would fill both sides of a pair. This
page lists the pairs and explains the one thing people try next.

The pairs

1. Proposing an appointment and approving it.
2. Proposing a delegation and approving it.
3. Writing a policy and activating it.
4. Validating a policy and being its only activator.
5. Operating a control and testing it.
6. Operating a control and issuing the finding against it.
7. Recording a risk and accepting it.

The thing people try next

Signing in with the other account.

It does not work. LEAT compares the person, not the login, using the
employee code rather than the user id. Two accounts belonging to one
employee are one person to every check in the system.

That is not an accusation. Holding two logins is ordinary here, and this
is written down so nobody wastes an afternoon discovering it.

The limit of that, stated plainly

If one human being is enrolled twice, as two employees with two
different employee codes, LEAT sees two people.

Nothing in this module can detect that, and nothing here pretends to.
Catching duplicate enrolments is HR's job at the point somebody is
added, and a governance system guessing at it would start refusing real
colleagues who happen to share a name.

We would rather write that limit down than let somebody assume it is
covered.

When there genuinely is nobody else

It happens in an organisation this size. The answer is not to switch the
check off — there is no setting that does — but to record an exception:
dual-authorised, expiring, with compensating controls named, appearing
on the board's exception report until it lapses.

An exception is visible and expensive. That is the point.