Accounting technology / Glossary / Segregation of duties

What is segregation of duties?

Definition

Segregation of duties is the internal control principle that no single person should be able to carry out a transaction from start to finish and also conceal an error or fraud in it. The main duties kept apart are authorising transactions, recording them, holding the assets, and reconciling or reviewing the results.

Also calledSoDseparation of duties

Compare the softwareBest audit software →All 8 audit vendors →

Keeps apart: Authorise, record, hold, review
Enforced by: Role-based system access
Category: Audit

How segregation of duties works

In accounts payable, one person sets up suppliers, another enters invoices, a budget holder approves them and someone else releases payment, with a reconciliation by a person not involved in any of those steps. In payroll, whoever changes pay rates should not also run the payroll. In the ledger, preparers of manual journals should not approve their own entries. Systems enforce it through role-based access: an SoD matrix lists which combinations of permissions conflict, and access reviews check that nobody holds them. Small finance teams often cannot separate every duty, so they rely on compensating controls, such as owner review of bank statements and payments, or detailed review of system logs. ERPs such as NetSuite and Sage Intacct and AP platforms such as BILL, Tipalti and Coupa assign approval rights by role and log who did what.

Common questions

What is an example of segregation of duties?+

In paying suppliers: one person adds a new supplier and its bank details, another enters the invoice, a manager approves it and a fourth person releases the payment. No one can create and pay a fake supplier alone.

What are compensating controls?+

Extra checks used when duties cannot be separated, common in small teams. Examples are an owner reviewing every payment, a manager reviewing the bank statement monthly, or reviews of system activity logs.

What is an SoD conflict?+

A combination of system permissions held by one user that would let them complete and hide a transaction, such as creating suppliers and approving payments. Access reviews look for these conflicts and remove them.