Segregation of duties divides incompatible responsibilities among different people so one person cannot control an entire high-risk transaction. It reduces fraud and error by requiring independent action or review.
Which duties should be separated?
- Vendor creation and payment approval
- Payment preparation and release
- Order approval and goods receipt
- Invoice entry and reconciliation
- User administration and access review
- Asset custody and record keeping
How does it work in payments?
A maker prepares the instruction, an authorized checker reviews it and a controlled role releases it. Beneficiary changes may require separate verification before payment approval.
What if a small team cannot fully separate duties?
Use compensating controls such as independent retrospective review, lower limits, restricted access, bank alerts and owner oversight. Document the unresolved risk.
Segregation vs. approval hierarchy
An approval hierarchy defines who can authorize by amount or risk. Segregation prevents one person from performing conflicting stages. Both may be needed.
How should conflicts be monitored?
Define toxic role combinations, test actual system access and review temporary or emergency permissions. Policy alone is insufficient if one user can perform every step.
