Segregation of duties

What it means

Segregation of duties is a principle of internal control under which no single person should hold every step of a sensitive process. Four functions are separated in particular: authorising a transaction, executing it, custody of the related assets and recording it. If one person has all of them, they can make an error or commit fraud and conceal it without anyone noticing.

The classic example is the payment process. If one employee sets up new suppliers, approves their invoices, enters payments and reconciles the bank statement, nothing stops them from creating a fictitious supplier and paying their own account. With these steps separated, they would need to collude with someone else, which makes fraud much harder.

The principle is often called the four-eyes principle. It is not about distrust of particular people but about systemic protection that shields both the company and its staff. An honest employee suspected of an error is protected by the fact that someone else also checked the transaction.

How it works in practice

When implementing it we start with a map of key processes: purchasing and payments, sales and invoicing, payroll, petty cash and changes to master data. For each step we set who performs it and who approves it. The greatest risk usually lies in changing a supplier's bank account, which attackers exploit in BEC fraud.

In a small company without enough people for full separation, compensating controls are used. The managing director personally approves all payments in online banking, an external accounting firm independently checks the reconciliation, and the list of new suppliers and account changes is reviewed monthly. Even such simple measures reduce risk considerably.

Segregation must also be reflected in systems. Access management in the accounting software and the bank should match roles: whoever prepares a payment should not be able to send it alone. An audit log then lets you trace who changed what. Settings should be reviewed regularly, especially after an employee leaves or changes role.

What to watch out for

The weakest point is exceptions. The only approver is on holiday, so a password is lent to a colleague, or a check is skipped for an urgent payment. These are exactly the moments attackers and dishonest employees look for. Rules for deputising should be set in advance, not improvised.

Segregation of duties only works if the second person genuinely checks rather than rubber-stamps. The approver should see the supporting documents, not just the amount and the name. Internal audit or an external reviewer should now and then test a sample of transactions to see whether approval has become a mere formality.