customer (AR Payee) Bank Details Audit

Objective: To track changes to customer bank details as these can be used for AR Refunds.

Summary:

Inserts and updates to bank account details for customers are not approved. AR managers have access to issuing refunds (up to their approval limit) and amending customer details. This feels like a control risk, how do other Oracle customers manage this?

Looking in the audit policies I can see party site and party can be tracked for External Payers, however this is not the case for External Payees. Tracking External Bank Accounts captures inserts/updates to bank account details, but not to which parties are using them (i.e. where the bank account details are being used).