It is Friday afternoon, and a supplier invoice arrives marked “urgent.” The procurement manager says the goods were received, the finance team is asked to pay immediately, and the usual reviewer is away. One employee can create the supplier record, enter the invoice, and release the payment.
Nothing may be wrong with the invoice. But the process has created an opening: a false vendor could be added, a genuine invoice could be duplicated, or an error could pass through because nobody with independent visibility challenged it.
This is why strong organizations do not rely on trust alone. They build processes in which important financial actions are divided among people, reviewed through evidence, and visible to someone who did not initiate them.
Segregation of duties, often called SoD, is one of the most practical preventive controls in accounting. It helps stop fraud before money, inventory, data, or accounting records can be manipulated—and it catches many ordinary mistakes along the way. 🔒
🧩 1. What Segregation of Duties Means
Segregation of duties means assigning different stages of a transaction or process to different people. No one person should be able to initiate, approve, record, control, and conceal a significant transaction without independent involvement.
The goal is not to make every task slow. The goal is to prevent incompatible powers from sitting with one individual, especially where cash, inventory, master data, or financial reporting is involved.
🎯 2. The Control Objective Behind SoD
Every internal control should answer a risk question. For SoD, the question is simple: could one person make an unauthorized transaction happen and hide the evidence?
If the answer is yes, the process has a control weakness. Separating duties reduces that possibility by requiring coordination, evidence, or review from more than one person.
🛑 3. Why Prevention Is Better Than Detection
Detective controls identify problems after they occur. Bank reconciliations, exception reports, and internal audits are valuable examples, but they may find an issue only after funds have left the business.
SoD is primarily preventive. A person who can enter a fictitious supplier but cannot approve payments, for example, faces a barrier before a loss occurs.
Prevention does not eliminate the need for detection. It reduces the number of opportunities that detection must later uncover. 🧱
🔺 4. The Fraud Triangle Explains the Risk
Fraud is often discussed through three conditions: pressure, opportunity, and rationalization. An organization cannot fully control an employee’s personal pressures or private justifications.
It can, however, reduce opportunity. Segregation of duties makes misconduct harder to execute alone, harder to conceal, and more likely to require a risky collaboration with others.
💵 5. The Four Core Functions to Separate
Many transaction cycles contain four broad functions. The exact job titles vary, but the functions should be considered separately:
- Authorization: approving that a transaction is legitimate, necessary, and within authority.
- Custody: holding or controlling cash, inventory, blank check stock, payment credentials, or valuable assets.
- Recordkeeping: entering transactions, maintaining ledgers, and updating master data.
- Reconciliation or review: comparing independent records, investigating differences, and confirming accuracy.
Combining all four functions in one role creates an obvious risk. Combining even two can be problematic depending on the transaction’s value and complexity.
🧠 6. Incompatible Duties Are the Central Idea
An incompatible duty is a pair of responsibilities that should not normally be performed by the same person because the combination allows an error or fraud to be created and hidden.
For example, someone who handles customer payments should not also prepare the bank reconciliation. They could take a payment and alter records or reconciliation items to conceal the shortage.
📥 7. Accounts Payable Is a Classic Example
Accounts payable involves supplier setup, purchasing, receiving, invoice processing, approval, payment, and reconciliation. Each stage produces evidence that can challenge the others.
A sound process does not necessarily require a different employee for every click. It does require that the most sensitive combinations—particularly vendor creation and payment release—are independently controlled.
Useful separations in accounts payable
- The person who creates or changes vendor master data should not approve payments to that vendor.
- The person who enters invoices should not be the sole approver of invoices.
- The person who releases electronic payments should not reconcile the bank account.
- The person confirming receipt of goods or services should be independent from the supplier where practical.
📄 8. Three-Way Matching Adds Independent Evidence
A common accounts payable control is the three-way match. It compares a purchase order, receiving evidence, and supplier invoice before payment.
The purchase order shows what was authorized. The receiving record supports that goods or services were received. The invoice shows what the supplier requests for payment.
When separate people or systems create these records, a false invoice has more obstacles to overcome. A match does not guarantee legitimacy, but it creates a structured challenge to unsupported payments.
🏦 9. Cash Receipts Need Separation Too
Fraud risk is not limited to payments leaving the organization. Incoming cash, checks, card payments, and electronic receipts also need controlled handling.
Ideally, the person opening mail or receiving payments is not the same person posting customer balances and preparing the bank reconciliation. This division helps ensure that recorded receipts agree with deposits and customer accounts.
💳 10. Payment Approval Is Not the Same as Payment Release
Organizations often confuse approval with execution. An approved payment request confirms that payment is appropriate; releasing the payment instructs the bank or payment platform to send funds.
These are distinct risk points. If the same person can create a vendor, prepare an invoice, approve it, and release payment, a formal approval field may provide little real protection.
| Process step | Main question answered | Preferred independent role |
|---|---|---|
| Vendor setup | Is the payee legitimate? | Master-data administrator or reviewer |
| Invoice entry | What does the supplier claim? | Accounts payable processor |
| Invoice approval | Was the purchase authorized and received? | Budget owner or operational manager |
| Payment release | Should funds be sent now? | Authorized payment approver |
| Bank reconciliation | Do bank activity and books agree? | Independent accounting reviewer |
🧾 11. Vendor Master Data Is a High-Risk Asset
Vendor records may contain legal names, addresses, tax details, banking instructions, and payment terms. Changing these details can redirect money without changing the underlying invoice amount.
For that reason, vendor additions and bank-detail changes should be restricted, documented, and independently reviewed. A callback or separate confirmation process may be appropriate for sensitive changes, especially when payment instructions change.
📦 12. Inventory Requires Custody and Recordkeeping Separation
Inventory can be stolen, miscounted, damaged, or written off improperly. The employee with physical access to stock should not have unrestricted power to adjust inventory records.
Independent cycle counts and investigations of count differences create accountability. If one employee both controls stock and records adjustments, missing inventory can be disguised as a bookkeeping correction.
🏭 13. Purchasing Must Not Be a One-Person Loop
In purchasing, a single employee should not normally select a supplier, authorize the purchase, confirm receipt, and approve the invoice. That person could favor an undisclosed related party, order unnecessary goods, or approve goods never received.
Separating supplier selection, purchase authorization, receiving, and invoice approval helps make the transaction traceable from business need to payment.
👥 14. Payroll Has Its Own Sensitive Combinations
Payroll combines confidential employee data with recurring payments. A person who can add employees, change pay rates, process payroll, and approve payroll output has extensive opportunity to create false or inflated payments.
Human resources, payroll processing, and payroll approval should have clearly defined responsibilities. Periodic review of employee lists, pay changes, and bank-account changes adds another layer of scrutiny.
Examples of payroll warning signs
- Employees with missing or unusual personnel documentation.
- Unexplained changes to bank details or pay rates.
- Payments continuing after a termination date.
- Multiple employees sharing information that warrants review under the organization’s policies.
📊 15. Financial Reporting Also Needs SoD
Segregation of duties matters even when no cash moves. Journal entries, estimates, account reconciliations, and consolidation adjustments can materially affect reported results.
The person preparing a significant manual journal entry should not be its only approver. Likewise, the preparer of an account reconciliation should usually be different from the reviewer who assesses supporting evidence and unresolved reconciling items.
✍️ 16. Manual Journal Entries Deserve Extra Attention
Manual entries are useful for valid adjustments, corrections, accruals, and closing activities. They also bypass some of the routine controls embedded in transaction systems.
A controlled journal-entry process typically requires a clear explanation, supporting documentation, appropriate account coding, and approval by someone with sufficient knowledge and independence. Entries posted late, reversed unusually, or made directly to sensitive accounts deserve review.
🖥️ 17. System Access Is Segregation of Duties in Digital Form
Modern accounting processes live inside enterprise systems, banking portals, payroll platforms, and cloud applications. User access determines what a person can create, approve, edit, and view.
Therefore, SoD is not only an organizational-chart issue. It is also an access-control issue. Permissions should reflect assigned responsibilities and should not quietly grant incompatible capabilities.
🔐 18. Role Design Should Follow the Process
Effective access roles are designed by mapping the transaction flow first. Teams should identify where data enters, where approval occurs, where assets move, and where records are reconciled.
Then they can decide which permissions belong together and which must remain separate. Giving broad access merely because it is convenient often creates a control problem that is difficult to see later.
⚠️ 19. Common System Conflicts to Watch For
Some conflicts appear repeatedly across accounting systems. They are not automatically unacceptable, but each requires an intentional response.
- Create or edit vendors and create payments.
- Create purchase orders and approve those same purchase orders.
- Enter invoices and approve invoice exceptions.
- Process payroll changes and approve payroll runs.
- Post journal entries and approve or review the same entries.
- Administer user access and approve one’s own access requests.
The risk is strongest when a person can use the combination without leaving independent evidence for another person to assess.
🧑💼 20. Managers Need Authority Limits
Approval is meaningful only when the approver has appropriate authority, relevant knowledge, and enough independence from the transaction. A manager should understand what they are approving rather than simply clearing a queue.
Organizations often define approval limits by transaction type, value, department, or risk level. Escalation rules are particularly important for unusual transactions, related parties, exceptions, and emergency requests.
🚨 21. Emergency Requests Need Controlled Exceptions
Urgency is often legitimate: a critical supplier may need payment, a system outage may disrupt normal workflow, or a key employee may be unavailable. Yet urgency can also be used to pressure staff to bypass controls.
A good exception process documents why the normal workflow was not followed, identifies who authorized the exception, and requires prompt independent review afterward. An exception should be visible, not informal.
🏢 22. Small Businesses Face a Real Constraint
Smaller organizations may not have enough staff to separate every duty fully. This does not mean they should abandon SoD; it means they should use practical compensating controls.
A business owner or senior manager can provide independent review even if they are not involved in daily processing. The key is to focus limited attention on the highest-risk combinations.
Practical compensating controls
- Review bank statements and cleared payments directly from the bank.
- Require dual authorization for significant electronic payments.
- Review vendor additions and bank-detail changes regularly.
- Compare payroll reports with authorized employee records.
- Review unusual journal entries and reconciliations each month.
🔎 23. Reconciliations Make Concealment Harder
A reconciliation compares two sources of information that should agree, such as bank records and the general ledger, inventory counts and inventory records, or subledgers and control accounts.
Its power comes from independence. If the person responsible for an asset also prepares and clears their own reconciliation without review, the control may fail to reveal what it was meant to find.
📈 24. Monitoring Confirms That Controls Still Work
Controls can weaken over time. Employees change roles, temporary access becomes permanent, system updates alter permissions, and teams develop workarounds under deadline pressure.
Periodic SoD reviews should compare assigned system access with actual job responsibilities. They should also inspect conflict reports, override activity, dormant accounts, and unresolved exceptions.
🧭 25. Documentation Turns Intent into a Repeatable Control
Verbal expectations are not enough. A documented process identifies the transaction steps, responsible roles, required evidence, approval thresholds, exception procedures, and review frequency.
Documentation helps new employees understand boundaries and gives auditors, managers, and process owners a common reference point. It also exposes vague phrases such as “someone reviews it,” which should be made specific.
🗺️ 26. A Simple SoD Matrix Makes Gaps Visible
An SoD matrix lists key activities across the top or side of a worksheet and maps which roles can perform them. The purpose is to spot where one role has conflicting powers.
For example, a matrix might include vendor creation, purchase-order approval, invoice entry, payment release, journal posting, and bank reconciliation. It should distinguish between ability to prepare, approve, modify, and review.
The matrix is not merely a compliance document. It is a design tool that helps teams discuss risk before a problem occurs. 🗺️
🤝 27. Controls Must Be Paired With a Healthy Culture
SoD works best in an environment where employees can question unusual requests, report concerns, and decline inappropriate shortcuts without retaliation. A technically sound workflow can still be bypassed when people feel pressured to obey without asking questions.
Leaders set the tone when they respect approval rules, avoid sharing credentials, and treat exceptions as matters requiring documentation rather than favors. Trust and controls are not opposites; clear controls protect both the organization and its employees.
✅ 28. The Core Principle: No One Should Control the Whole Story
The central principle of segregation of duties is straightforward: the person who starts a transaction should not be able to complete, record, and conceal it alone. Independent authorization, custody, recordkeeping, and review create checkpoints that make transactions more reliable.
Well-designed SoD does not accuse employees of dishonesty. It recognizes that people make mistakes, systems can be misused, and financial processes need evidence that stands apart from the person who initiated the activity.
When responsibility is shared intelligently, fraud has fewer places to begin and far fewer places to hide. 🔒🧾👥
