Segregation of Duties: A Setup Guide for Small Finance Teams

Every cash transaction has three separate jobs: recording it in the books, authorizing it, and having physical or digital custody of the asset (the bank login, the check stock, the card). Fraud happens when one person holds two or three of those jobs at once. A bookkeeper who both enters vendor invoices and has login access to release ACH payments can pay a fake vendor and clean up the entry afterward. Split those two jobs across two people, even part-time ones, and that same fraud now needs two people to agree to commit it.

With only a bookkeeper and a controller or owner, you still have room to split duties if you're deliberate about it. Have the bookkeeper enter bills, code expenses and prepare the payment batch. Reserve final approval and payment release for the controller or owner, and have that same second person be the only one who can add a new vendor to the system. New vendor setup is the control point people forget: if the person entering bills can also create vendors, they can create one that pays themselves.

• Bookkeeper: enters bills, codes GL accounts, prepares payment batches
• Owner or controller: approves the batch, releases payment, adds new vendors
• Owner or controller: performs the monthly bank reconciliation, not the bookkeeper

Once you're past a handful of finance staff, add a third split: someone outside the AP function should reconcile the bank account. If the same person who enters and pays bills is also the one reconciling cash, they can hide a fraudulent payment by simply not flagging it during reconciliation. Payroll changes deserve the same treatment: the person who runs payroll shouldn't also be the only one who can change an employee's pay rate or direct deposit account without a second sign-off. Days payables outstanding varies a lot by industry¹, so set your approval dollar thresholds against your own typical payment cycle rather than copying a number from a different kind of business.

If you truly run AP with one bookkeeper and no one else in finance, you can't eliminate the risk, but you can compensate for it. Have the owner personally review the bank and credit card activity every week, not just at month-end. Turn on bank alerts for any payment over a set amount. Ask the bank about positive pay, which matches every check against a list the owner approves before it clears. And have someone outside finance, even a fractional controller who logs in once a month, do the account reconciliation so the same hands that pay the bills never verify the bank balance.

A written policy that says two people are involved in every payment means nothing if your accounting software still gives one login every permission in the system. Go into your user permissions and actually remove the ability to both enter and approve payments from any single role. Review that permission list at least twice a year, because it's common for someone to get temporary approval access during a vacation cover and never get it removed. A checklist tool that forces a documented sign-off step before a batch moves to payment closes this gap without adding a new hire.

The same logic applies to your card program and expense reimbursements, which finance teams tend to treat as lower risk than AP even though the same three duties (recording, approving, custody of the card or the reimbursement) apply just as much. Whoever reviews and codes expense reports shouldn't be the same person who can raise their own card limit or approve their own reimbursement. If your expense tool lets a manager approve their own submitted report by default, turn that setting off; it's a common gap left over from a smaller team's original setup that nobody revisits once headcount grows.