Segregation of duties means no single person controls every step of a financial transaction. Authorising a transaction, recording it, holding or moving the asset, and checking the result are given to different people, so an error or a fraud by one person is caught by another.
What is segregation of duties?
Segregation of duties (SoD) is a basic internal control. If one person can add a supplier, approve its bill, prepare the payment and reconcile the bank, nothing stops them paying themselves, and nobody would notice an honest mistake either. Splitting those steps means every transaction passes through at least two people.
The four duties usually kept apart are authorisation, recording, custody of assets, and reconciliation or review. Where one person must hold two of them, another person reviews their work.
How do you apply segregation of duties?
| Process | Keep apart | Why |
|---|---|---|
| Payments | Changing supplier bank details, preparing payments and releasing them | Stops payments to an account someone controls |
| Purchasing | Raising the order, receiving the goods and approving the bill | Stops paying for goods never ordered or received |
| Journals | Preparing a journal and approving or posting it | Stops unchecked entries changing the results |
| Receivables | Recording receipts and issuing credit notes or write-offs | Stops receipts being hidden behind credits |
| Bank | Recording cash and reconciling the bank | Means an independent person checks the cash |
| Access | Requesting system access and granting it | Stops anyone giving themselves rights |
In a small team where full separation is not possible, use compensating controls: a manager reviews the bank reconciliation and the payment list every month, and every change to supplier or customer master data is logged and reviewed.
What does a segregation of duties fix look like?
Why does segregation of duties matter?
A conflict lets one person both cause a problem and hide it, which is why auditors look at who can do what. Conflicts also build up quietly: people change roles and keep old access, or cover for colleagues on leave and never hand the rights back.
Check conflicts in every system that can move value: the ERP, the bank portal, the payroll system and any finance tool. Review access at least yearly and whenever someone changes role. Pair it with the four-eyes principle for single high-risk steps, and see the guide to the approval matrix and segregation of duties for a full matrix.
Questions people ask
What is the difference between segregation of duties and the four-eyes principle?
Segregation of duties splits a process across people so no one controls it end to end. The four-eyes principle requires a second person to check or approve one specific action. Four eyes is one way to achieve segregation for a single step.
How can a small finance team segregate duties?
Split the highest-risk pairs first, such as bank-detail changes and payments, and use the owner or a manager as the independent reviewer. Where a conflict remains, add a review: a monthly check of the payment list, the bank reconciliation and master data changes.
Do segregation of duties rules apply to system accounts and API keys?
Yes. An integration or system account that can both create and approve transactions is a conflict like any other. Give it only the rights it needs, and keep approvals with people.