What Is Segregation of Duties in Accounting?
Segregation of duties is an internal control that splits a money task among different people, so no one person can approve a transaction, handle the cash or asset, record it in the books and check the records afterward. Because each step is seen by someone else, theft and honest errors are much harder to hide.
At a 10-person plumbing company, the office manager enters vendor bills, the owner approves them and releases the payments, and an outside bookkeeper matches the bank statement to the books each month, so nobody can take money and hide it without help from another.
The four duties to keep apart
Internal controls are the routines a business uses to protect its money and keep its records right, and segregation of duties is a basic one.
The U.S. Government Accountability Office's Green Book, the internal control standard for federal agencies (2025 edition, in effect from federal fiscal year 2026), describes it as separating "the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets so that no one individual controls all key aspects of a transaction or event." The GAO says state and local governments and nonprofits may adopt the Green Book as a framework too. It isn't a rule for private businesses, but a small company can borrow from it.
In plain words, that is four jobs:
| Duty | What it means | Examples at a small contractor |
|---|---|---|
| Authorize | Say yes to spending or a payment | Approving a bill, a new vendor or a card charge |
| Hold the asset | Control money or things worth money | Keeping the checkbook or the office cash box, holding a company card, having a bank login that can send payments |
| Record | Put transactions into the books | Entering bills, adding vendors, coding card charges, posting journal entries (manual adjustments to the books) |
| Reconcile | Compare the books with outside evidence and review the results | Matching the bank statement to the books, counting inventory, reviewing reports |
Some pairs cause more trouble than others. Whoever records transactions shouldn't also reconcile them, or they can hide their own mistakes. Whoever can send money shouldn't also be able to add or edit a vendor. And nobody should approve their own spending.
Why separating duties matters
The Green Book says segregation of duties helps prevent fraud, waste and abuse, and can reduce the risk of management override, where someone in charge sidesteps the controls. It also names the limit: segregation reduces that risk but can't absolutely prevent it, because of collusion, "where two or more employees act together to commit fraud, waste, or abuse." One person acting alone is the case it handles well.
Fraud losses land harder on small companies. The Association of Certified Fraud Examiners' Occupational Fraud 2026 report analyzed 2,402 cases from 143 countries and territories. Organizations with fewer than 100 employees had the highest median loss of any size group, $126,000. That's only slightly above the $123,000 at organizations with 10,000 or more employees, and the ACFE says median losses didn't vary significantly by size. The difference is the effect: the same loss is likely a much larger share of a small company's revenue.
Billing schemes, where a business pays fake or inflated bills, showed up in 28% of their cases, against 18% at larger organizations. Across all cases, the main control weakness was a lack of internal controls in 33% and an override of existing controls in 19%.
Honest errors matter too. A second person looking at a bill catches the duplicate invoice or the extra zero long before year-end.
A fraud example: the vendor that wasn't real
A roofing company with nine employees has one bookkeeper who does everything with money. She adds vendors, enters bills, prints checks with the owner's signature stamp and reconciles the bank account. The owner trusts her and mostly reads the profit and loss statement, the monthly report of income and expenses.
She sets up a vendor whose name is one letter off from the company's real shingle supplier, with a mailing address she controls. Over 14 months she enters 26 bills averaging $1,850, all coded to materials on busy jobs. That's $48,100 (26 x $1,850). Because she also reconciles the bank account, nobody else sees the payee on the cleared checks (checks the bank has already paid). The jobs look a little less profitable, and the owner blames material prices.
Fourteen months is typical: in the ACFE study, billing schemes ran a median of 14 months before they were caught. Any one split duty would likely have ended this sooner. If the owner approved new vendors, the lookalike name would have drawn a question on day one. If the bank statements went to the owner first, 26 checks to an unfamiliar payee would have stood out within a month or two.
How a 5- to 15-person company can compensate
Most small companies can't hire a second bookkeeper just to split duties. The Green Book, though written for government, makes the same point. It says a smaller entity "faces greater challenges in segregating duties because of its concentration of responsibilities and authorities," and can respond with extra levels of review for key processes, reviews of randomly selected transactions and their supporting documents, periodic asset counts or checks of supervisor reconciliations. Where a full split isn't practical, it calls for alternative controls. Accountants call these compensating controls.
In a company of 5 to 15 people, the owner is usually the second set of eyes. A workable set looks like this:
- The owner approves every new vendor and every change to a vendor's bank details, and confirms bank changes by calling the vendor at a number already on file.
- Bank and card statements go straight to the owner, mailed to the owner's address or read in the owner's own online login, before the bookkeeper sees them.
- The bookkeeper prepares payments, and the owner releases them.
- Whoever runs the books takes a mandatory vacation of at least one full week a year, and someone else does the work while they're gone. Schemes that need daily upkeep tend to come apart.
- Once a month, the owner reviews the bank reconciliation, voided checks, credit memos (vendor credits that reduce what you owe) and manual journal entries, then initials and dates the review.
- The owner picks five transactions at random each month and asks for the receipts or invoices.
- An outside accountant reviews the books at least once a year.
If you start with only two, make them owner approval of vendor changes and owner review of bank statements. Those two go straight at billing and check fraud. In the ACFE data, check and payment tampering showed up in 18% of small-organization cases, against 8% at larger ones.
Splitting duties inside your software
Separation on paper means little if everyone shares one login. In your accounting system and your bank portal, give each person their own user and only the rights their job needs. The bookkeeper can enter bills and vendors without being able to release payments. The owner can approve and pay without editing the vendor list. Keep admin rights with the owner, and use them only for setup, not for day-to-day vendor changes.
Then walk through your accounts payable process, the path a vendor bill takes from arrival to payment, and look for any step where one user can do two of the four duties. Company cards need the same check: the cardholder shouldn't approve their own charges or do the credit card reconciliation for their own card.
Clyr's roles and permissions set view, code, approve and pay per area, so the person who codes a bill doesn't have to be the one who approves or pays it. New users start as members.
Common mistakes
- Splitting duties on the org chart while everyone shares one bank login.
- Rubber-stamp approvals, where the owner approves a batch of 40 bills without opening one.
- "Just this once" exceptions in a busy week that quietly become the process.
- Letting the person who reconciles also post the adjusting entries that make the reconciliation balance, with nobody reviewing them.
- Owner overrides with no written reason, which teach everyone that the rules are optional.
FAQs
For most private small businesses, no general federal rule requires it. The exception is a federal award: under 2 CFR 200.303, recipients and subrecipients must establish, document and maintain effective internal control over the award, which should align with the Green Book or the framework from COSO (the Committee of Sponsoring Organizations of the Treadway Commission). For-profit companies are covered where the awarding agency applies these rules to them. A contractor hired by a recipient to supply goods or services usually isn't a subrecipient. Your CPA can confirm what applies.
Segregation of duties gives different steps to different people. Dual control puts two people on the same step, such as two signatures on checks over $5,000 or two people counting a cash deposit together. Small businesses often use dual control on payments as a compensating control, because it adds a second person without hiring a second bookkeeper.
If the owner does everything alone, the money at risk is the owner's own, so the bigger danger is error rather than theft. An outside accountant reviewing the books once a year covers most of that. The picture changes with the first employee who touches money. From then on, the owner should keep at least one duty, usually releasing payments or reading the bank statements.
The usual blind spot is the person who reconciles everyone else's cards and also carries one, often the office manager. Her own statement should be reconciled by someone else. A credit limit isn't a substitute either: it caps the damage but says nothing about what was bought.
No. Two people working together can beat it, as the Green Book itself warns. You can make collusion harder: keep relatives and partners out of the same payment chain, rotate who approves your biggest vendors, and run reviews the people involved can't plan around. A vendor chasing a bill your books show as paid is another warning sign.
