Segregation of duties

Segregation of duties means no single person controls a transaction from start to finish. The classic split has four functions:

• Authorisation — approving a transaction (a credit limit, a purchase order, a pay rise).
• Custody — handling the asset (receiving cheques, holding inventory, releasing payments).
• Recording — entering transactions in the accounting records.
• Reconciliation and review — checking that records agree with reality (bank reconciliations, supplier statement reconciliations, inventory counts).

The test for an incompatible combination is simple: could the person both commit an error or fraud and conceal it in the normal course of their work? A cashier who also posts receipts to customer accounts can pocket one customer's payment and cover it with the next customer's — lapping. A clerk who can set up suppliers and approve payments can create a fictitious supplier and pay it. A payroll officer who can add employees and run the payroll can pay a ghost.

Segregation must also exist inside the system. If an ERP role lets one user create a supplier, change its bank details and release a payment, the paper policy doesn't matter. Reviewing user access against a conflict matrix is a routine audit and internal-audit procedure.

Small entities often can't segregate fully — three people can't fill four independent roles across every process. The answer is compensating controls, usually performed by an owner or manager who isn't involved in day-to-day processing:

• the owner receives bank statements (or read-only bank access) directly and reviews them;
• the owner approves every payment, or releases payments in the banking platform, with supporting documents attached;
• a monthly reconciliation is performed or reviewed by someone outside the process (the owner or an external accountant);
• system reports of changes to supplier, customer and employee master data are reviewed;
• staff take mandatory holidays, during which someone else does their job.

Compensating controls must be performed by someone independent and must be evidenced — a reconciliation nobody can show was reviewed gives the auditor nothing to test.