What Is Segregation of Duties?
Segregation of duties (SoD), also called separation of duties, is an internal control that splits the steps of a transaction across different people so no single individual can execute and conceal an error or fraud on their own. The two terms mean the same thing; segregation is the more common usage in accounting and separation is more common in IT and information security.
The Four Functions That Must Be Separated
- Authorization
Approving that a transaction should happen, such as signing off on a purchase or an invoice. - Custody
Controlling the asset itself, such as access to bank accounts, cash, or inventory. - Record keeping
Entering the transaction into the accounting system. - Reconciliation
Independently verifying that records match reality, such as reconciling the bank statement.
The control holds as long as no one person performs two functions that together allow both committing and concealing a problem. Authorization plus custody is the most dangerous pairing, followed by custody plus record keeping.
What Is a Segregation of Duties Matrix?
An SoD matrix is a grid that maps roles against tasks to show which combinations create a conflict. Roles run down one axis, system functions or duties run across the other, and each intersection is marked as permitted, prohibited, or permitted only with a compensating control.
It is used for two purposes: designing role permissions before they are granted, and evidencing to an auditor that conflicts were identified and addressed rather than discovered after the fact.
EXAMPLE
A simplified AP matrix might show that the role holding vendor master maintenance must not also hold payment execution, and that invoice entry combined with invoice approval is prohibited above a stated dollar threshold. Each prohibited cell either gets a role change or a documented compensating control.
Segregation of Duties in Accounts Payable
AP is where a business sends money out, across a high volume of transactions and vendors, which makes it the most common target for occupational fraud. Four AP duties should sit with different people:
- Vendor master maintenance
Adding vendors and changing bank details. - Invoice entry and coding
Recording the payable in the system. - Invoice approval
Authorizing that the amount is owed and correct. - Payment execution
Releasing funds from the bank.
The single most important separation is vendor master maintenance from payment execution. One person holding both can create a payee and pay it.
EXAMPLE
An AP clerk with vendor setup rights and payment authority adds a fictitious supplier with their own bank details, approves a modest invoice against it, and executes the payment. Because the same person also reconciles the account, nothing surfaces. Schemes structured this way typically run for months, and most are found through an unrelated audit rather than internal review.
Segregation of Duties and SOX Compliance
For US public companies, Section 404 of the Sarbanes-Oxley Act requires management to assess and report on the effectiveness of internal control over financial reporting, with the external auditor attesting to that assessment. SOX does not name segregation of duties as a specific requirement, but SoD conflicts are among the most frequently cited control deficiencies in practice.
What auditors look for is threefold: that conflicts were systematically identified, usually through a matrix; that access in the ERP actually matches the documented design; and that where separation was not possible, a compensating control was defined and evidenced. A policy document with no supporting logs is generally not sufficient.
Private companies are not subject to SOX, but lenders, insurers, acquirers, and audit firms frequently apply similar expectations during diligence.
Segregation of Duties in a Small Finance Team
The textbook model assumes enough staff to spread four functions across four people. A mid-market business with two people in finance cannot do that, and pretending otherwise is how control gaps get papered over in audit documentation.
The practical answer is compensating controls: measures that reduce risk without requiring additional headcount.
- Owner or executive review: someone outside finance reviews the payment register before it executes.
- Vendor change alerts: any change to bank details triggers notification to a second person.
- Independent bank reconciliation: performed by someone who cannot initiate payments.
- System-enforced approval limits: thresholds that cannot be overridden by the person they apply to.
- Positive pay at the bank: the bank verifies issued items against a list the business submits.
- Complete audit logging: every action attributable to a named user with a timestamp.
When processing is handled by a system rather than a person, the record keeping function leaves human hands entirely while authorization stays with named approvers. The separation becomes a matter of configuration rather than staffing, and the audit trail is generated automatically, which is what auditors can actually rely on.
Frequently Asked Questions About Segregation of Duties
1. What is segregation of duties?
Segregation of duties is an internal control that divides the steps of a transaction across different people so no single individual can both execute and conceal an error or fraud. The four functions to separate are authorization, custody, record keeping, and reconciliation.
2. What is a segregation of duties matrix?
An SoD matrix is a grid mapping roles against duties to show which combinations create a conflict. Each intersection is marked permitted, prohibited, or permitted with a compensating control. It is used to design role permissions and to evidence to auditors that conflicts were addressed.
3. What is segregation of duties in accounts payable?
In AP, four duties should sit with different people: vendor master maintenance, invoice entry, invoice approval, and payment execution. The most critical separation is vendor maintenance from payment execution, because one person holding both can create a payee and pay it.
4. What does SOX require for segregation of duties?
SOX Section 404 requires management to assess internal control over financial reporting rather than naming SoD specifically, but SoD conflicts are among the most cited deficiencies. Auditors look for a documented conflict analysis, ERP access matching that design, and evidenced compensating controls.
5. What is an example of segregation of duties?
The person who adds vendors and edits their bank details should not also be able to execute payments. If one individual controls both, they can add a fictitious supplier with their own account details and pay it, which is the most common structure of accounts payable fraud.
6. Is segregation of duties the same as separation of duties?
Yes, the terms are interchangeable. Segregation of duties is the more common phrasing in accounting and auditing, while separation of duties is used more often in IT and information security. Both describe the same control principle.
7. How can a small business achieve segregation of duties?
Through compensating controls rather than more headcount: executive review of the payment register, alerts on vendor bank detail changes, bank reconciliation by someone who cannot initiate payments, system-enforced approval limits, positive pay, and complete audit logging.
