The month is closed by a list, and reopened by a signature
A month locks only when its checklist is done — every day audited, the sub-ledgers agreeing, the bank reconciled — and at the lock the trial balance is snapshotted and hashed. What one person must not do alone gets a second signature. Finance audits each day before it is believed.
A month has been lockable since the ledger arrived. Now locking it is a list with an owner for each task, most of them checked by the machine, and reopening it is two people's decision.
The list
Every day audited and the sub-ledgers agreeing with the books are mandatory; the bank reconciled, the GST return prepared, the GRNI accrued and the sign-off are advisory until a hotel makes them mandatory. A manual task is ticked by a person; an automatic one is run and marked with its evidence. The lock refuses until the list is done, and at the lock it takes the snapshot: each hotel's trial balance, materialised and hashed, so the closed numbers cannot drift. Once every month of the year is locked, the year's revenue and expense roll into retained earnings.
Approvals
One machine for everything one person must not do alone. A rule per kind of thing — a manual journal, a refund, a write-off, a vendor bill with no purchase order, a vendor payment, a vendor bank change, a credit override, reopening a month, a rate override, an owner distribution, a budget — with a threshold, a department, the role that signs and up to three levels. Every level a different person; the requester cannot sign their own; a reject ends it. Delegation for leave cover, with the signature saying whose authority it was. Separation of duties reported: which two rights one person must not both hold, and who does. A closed month is reopened only with an approved request once the account has the rule.
The day, audited by finance
The night audit closes the day operationally. Finance's own look before the day is believed: the books equal the folios, no occupied room went uncharged, no comp went unapproved, no bill was left open past check-out, the day's voids and refunds are listed. The controller signs the day off; a day with a failing mandatory check cannot be signed until it is explained; the days nobody has signed are the group's worklist. A control account's balance can be certified for a month — a name against a number — and a legal hold marks a record that must not be archived or deleted while a dispute or an audit is live.