Segregation of Duties
An internal control principle requiring different people to handle different stages of a transaction to prevent fraud and errors.
Segregation of Duties (SoD) is a fundamental internal control principle requiring that no single individual has control over all stages of a financial transaction or process. By dividing responsibilities among multiple people, SoD reduces both the opportunity for fraud (no single person can commit and conceal it) and the risk of undetected errors (each person's work is reviewed by another).
The principle identifies four key functions that should be separated: authorization (approving a transaction), custody (physical control of assets), record-keeping (entering the transaction in the books), and reconciliation (verifying records against physical assets or external sources). When any two of these functions are performed by the same person, a control weakness exists; when the same person controls three or four, it creates a significant fraud risk.
Common SoD violations in practice: the same person who processes accounts payable also initiates wire transfers (authorization + custody combined); the controller who maintains the GL also reconciles bank accounts (record-keeping + reconciliation); an employee who manages petty cash also approves petty cash expenditures.
For small organizations with limited staff, perfect SoD is often impossible. Compensating controls — additional oversight mechanisms that reduce risk when SoD cannot be fully implemented — are the solution: owner or CFO review of all bank transactions, monthly external reconciliation, surprise cash counts, or board-level review of large transactions.
In ERP and accounting systems, SoD is enforced through role-based access controls (RBAC) that restrict each user to the minimum permissions needed for their function. Modern GRC tools (Archer, ServiceNow GRC, SAP GRC) include automated SoD conflict detection to identify permission overlap risks across complex enterprise systems.
FAQs
How can a 5-person company achieve adequate segregation of duties?
In small teams, compensating controls substitute for full SoD: owner review of all bank transactions and payment approvals, monthly bank statement review by someone separate from the bookkeeper, external accountant performing reconciliations, using accounting software that creates audit trails of all changes, and periodic audits of petty cash and expense reports.
What is an SoD conflict in ERP systems?
An SoD conflict exists when a user's system permissions allow them to perform two or more conflicting activities — for example, creating a vendor in the system AND approving payments to that vendor, or initiating a purchase order AND approving its receipt. ERP systems like SAP and Oracle have complex role matrices where conflicts can arise from seemingly unrelated roles being combined.
How do auditors test segregation of duties?
Auditors review the organizational structure and role assignments to assess whether key duties are properly separated. They test specific transactions to verify that different individuals authorized, recorded, and reconciled them. They also review system access reports to identify users with conflicting permissions and interview management about compensating controls for identified gaps.
Related Terms
Internal Controls
The policies, procedures, and practices designed to safeguard assets, ensure financial accuracy, prevent fraud, and promote operational efficiency.
Audit Trail
A chronological record of all user actions, system events, and data changes in a financial system, providing a traceable history for auditing and investigation.
SOC 2
A security audit standard developed by the AICPA assessing a service company's data security, availability, processing integrity, confidentiality, and privacy controls.
Bank Reconciliation
The process of matching a company's internal cash records to its bank statement to identify and resolve discrepancies.
