Segregation of duties: no one person from start to finish

Segregation of duties is the principle that no single person should control a transaction from beginning to end. The four functions that must be kept apart are authorising it, executing it, holding the asset, and recording it. Where one person holds two or more, the error or the theft can be committed and concealed by the same hand.

The classic case is the person who can add a supplier, approve an invoice and release the payment. Nothing about that is unusual in a small finance team, and nothing about it is safe: the fictitious supplier and the payment to it are created and blessed by the same person, and the record they produce is the only record.

Conflicts worth checking first

• Creating a vendor and approving payments to vendors.
• Approving a purchase order and receipting the goods against it.
• Processing payroll and adding or amending employees.
• Raising credit notes and handling customer receipts.
• Posting journals and reconciling the accounts those journals hit.
• Administering a system and approving its own access requests.

The last one is the most commonly missed, because it looks like IT rather than finance. Someone who can grant themselves rights can defeat every other separation on the list, which is why administrator access belongs on the same matrix as payment approval.

Building a segregation of duties matrix

1. List the actual duties performed in each process, in the words the team uses.
2. Mark each pair that must not sit with the same person, and note why.
3. Map the duties to real people and to the system roles that grant them.
4. Look at the roles, not the job titles — access accumulates as people move, and the title never updates.
5. Record each conflict you cannot remove, with the compensating control that covers it.
6. Retest after every reorganisation, because that is when conflicts appear.

A matrix that shows no conflicts in a team of five is a matrix that has not been tested against actual system permissions. Small teams always have conflicts; the useful output is not a clean grid but a short list of accepted conflicts, each with a named compensating control and a person who reviews it.

When you cannot segregate

Below a certain headcount, separation is arithmetic rather than policy — there are not enough people. The substitute is oversight by someone outside the process: the owner opens the bank statement themselves rather than reading a prepared summary; a director reviews new suppliers monthly; payments above a threshold need a second approver from outside finance.

These compensating controls only work if they are performed on the source, not on a report produced by the person being overseen. A summary written by the one person who does everything proves nothing about what everything was.

Because duties are enforced by whatever the system lets people do, the matrix and the permissions have to agree. Ettex Teams keeps roles and their permissions explicit per workspace, so the answer to "who can approve this" is a setting rather than a convention — and the periodic access control policy review compares the same list that the matrix was built from.