Separation of duties is an internal control principle under which the responsibilities for a transaction are divided among two or more people, so that no one individual controls it from start to finish. The classic division separates three functions: authorizing a transaction, recording it in the accounting records, and having custody of the related asset, such as cash or inventory. A fourth function, reconciling or reviewing the records, is also usually kept apart from the others.
The principle is also known as segregation of duties, and it is one of the most basic safeguards against fraud and error. If one person can, for example, approve a payment, make it and record it, that person could pay themselves and hide it. When the steps are split, the fraud would require collusion between employees, which is much less likely and easier to detect.
Examples of separated duties
- Purchasing and payments: one employee raises a purchase order, a manager approves it, the warehouse confirms receipt, and accounts payable staff pay only after matching all three documents. The person who adds new suppliers to the vendor list should not be able to approve payments to them.
- Cash receipts: the person who opens the mail and lists customer checks is not the person who posts payments to customer accounts, and neither prepares the bank reconciliation.
- Payroll: human resources adds and removes employees and sets pay rates, payroll staff process the payroll, and a manager reviews the payroll register before payment. This guards against ghost employees.
- Petty cash: a custodian handles the petty cash fund, but someone else counts it on a surprise basis and approves replenishments.
- IT systems: developers who write program changes should not move them into the live system, and users' system permissions should reflect their roles, often through role-based access control.
In banking and payments, the same idea appears as maker-checker or four-eyes controls, where one person enters a transaction and another must approve it before it is released.
A worked illustration
A small distributor lets its bookkeeper receive customer payments, deposit them, post them to the receivables ledger and reconcile the bank account. Over two years, the bookkeeper diverts $3,000 a month from cash customers, about $72,000 in total, and hides it by writing off the customers' balances as bad debts. Because the same person controls custody, recording and reconciliation, nothing in the records looks wrong. If the owner had simply opened the bank statements personally and reviewed write-offs, or had a second person post receipts, the scheme would have been very hard to carry out. Schemes of this kind are a common form of embezzlement in small businesses.
Regulation and audit
Separation of duties is a core element of the control activities component in the COSO internal control framework, which most US public companies use to assess their controls. Under Section 404 of the Sarbanes-Oxley Act of 2002, management of public companies must report on the effectiveness of internal control over financial reporting, and larger companies' independent auditors must attest to it under standards set by the Public Company Accounting Oversight Board (PCAOB). Auditors routinely look for conflicts in duties and in system access rights, and a lack of segregation is one of the most frequently reported control weaknesses in smaller public companies.
Compensating controls in small organizations
Small businesses often have too few staff to separate every duty. In that case, owners and managers use compensating controls, such as personally reviewing bank statements and canceled checks, signing all checks themselves, requiring two signatures above a limit, reviewing monthly reports for unusual items, rotating duties and requiring staff to take vacations, and using an outside accountant for reconciliations. Technology also helps: access control and audit logs record who did what. The controller or finance manager is usually responsible for designing the split of duties and reviewing it as the organization changes.