Segregation of duties
Splitting key steps of a financial process between different people. No one person can both make and hide an error or a fraud.
In short
- The classic split: whoever authorizes a transaction does not record it, pay it or reconcile it.
- It is a core internal control and a focus of every audit.
- Small teams that can't fully separate duties use review and monitoring to compensate.
Segregation of duties means that the steps of a financial process are divided so that no single person controls all of them. The goal is simple: if one person can create a transaction, approve it, record it and reconcile the account it lands in, nothing stops a mistake or a fraud from going unnoticed.
The four functions to separate
- Authorization: approving a purchase, payment or change.
- Custody: access to cash, cheques, inventory or bank systems.
- Recording: entering transactions in the accounting system.
- Reconciliation: checking records against independent sources.
Examples
- The person who creates new suppliers should not be the one who approves invoices or releases payments.
- The person who prepares a payment run should not be the one who releases it in the bank.
- The person who records cash receipts should not reconcile the bank account.
- An employee should not approve their own expense report.
For small businesses
A business with one bookkeeper cannot separate everything. Compensating controls fill the gap: the owner reviews bank statements directly, approves all payments, signs off on new suppliers and looks at a monthly report of manual journal entries. Systems help too, by enforcing approval rules and logging who did what.
Worked example
A gap and how it was closed
At a 30-person company, one AP clerk can create suppliers, enter invoices and prepare payments. An audit flags the risk. The company moves supplier creation to the controller, requires the CFO to release every payment run, and adds a monthly report of supplier bank changes reviewed by the owner.