You can apply this scheme on many different levels you need or your business flow request it. It's up to you how you organize the size of the levels.

That's why is important to have a cache level (mid-level) where somebody is doing all the management and funds allocation.

To reduce the risk, the best way is to compartmentalize the access, if you have more people managing at daily basis the funds. I learned this when I worked as IT systems guy in a bank, long time ago (that's why also my guide is named "think like a bank).

Multiple wallets, on multiple levels, with different access level. Is not easy, I know, but you are limiting a lot the leaks and losing funds.

The income txs is simple: always use xpubs (read-only wallets). In this way, anybody without signing keys can manage the accounting without having any option to move them (or steal).