Segregation of duties means no one person carries a transaction from start to finish
The idea is simple. Every movement of money involves four separate jobs, and the risk lives in one person holding more than one of them. Those jobs are custody (access to the bank, the cards, the cheque stock, the payment tokens), authorization (deciding the money should be spent and approving the invoice, the vendor or the pay change), recording (posting it to the ledger, creating the vendor, issuing the credit note), and review (reconciling the account to the statement and looking at what came out).
Splitting those jobs is not a statement about the person doing them. It is a statement about the design. A bookkeeper who can create a vendor, approve its invoice, pay it from the bank and reconcile the bank afterward has no independent check on her work, which means an honest keystroke error survives for months and a dishonest one is invisible. The same design also leaves her exposed: when something does go wrong, she is the only person who could have done it. Good segregation protects the people you trust as much as it protects the company.
The other reason to care is that most of what segregation catches is not fraud at all. It is the duplicate payment nobody noticed, the supplier paid twice because the invoice came by email and by mail, the payroll change entered against the wrong employee, the expense coded to the wrong company in a two-entity group. Those errors cost money quietly, and they are found by exactly the same second look that would find theft. We wrote separately about why internal controls matter even in an owner-managed business, and this page is the specific piece of that argument you have to solve when the whole finance team fits in one room.
The four jobs, and the combinations that actually cause losses
Not every overlap is equally dangerous. If you can only fix two things this quarter, fix custody plus review, and authorization plus recording. Everything else is a lower-grade risk you can manage with a monthly look. Here is the whole map, sized for a small business rather than a corporate control framework.
| The job | What it looks like in your business | Dangerous when the same person also has | Cheapest way to break it |
|---|---|---|---|
| Custody | Bank login with payment rights, corporate cards, cheque stock and signing, e-transfer access, petty cash, the payment app | Review, because the person who moves money also decides whether the record of it looks right | Reconciliation moves to someone else, or to your accounting firm, and the owner gets a read-only bank login of their own |
| Authorization | Approving purchase orders and invoices, approving a new vendor, approving a raise or a new hire, approving a customer credit or write-off | Custody, because approval and release become one click by one person | A second approver above a set dollar level, and owner approval for anything new: new vendor, new employee, new bank detail |
| Recording | Posting bills and payments, creating and editing the vendor and employee master files, journal entries, credit notes | Authorization, because the person who can invent a payee can also approve paying them | Vendor and employee setup is approved by someone who cannot post, and every master-file change appears on a monthly list |
| Review | Bank and card reconciliations, agreeing subledgers to the ledger, reading the exception list, the month-end close sign-off | Recording, because the person marking the work correct is the person who did it | The close is reconciled and signed off by someone who did not post the entries |
Read the table as a hierarchy rather than a checklist. Custody and review sitting together is the combination behind most losses in businesses your size, because it lets a problem persist rather than merely occur. Authorization and recording together is the combination that lets a payee exist who should not exist at all.
What this looks like when the finance team is one bookkeeper and you
With two people you can still cover all four jobs, as long as you accept that the owner has to hold one of them personally. The workable split is this: the bookkeeper records and prepares, the owner authorizes and reviews, and custody is shared with limits. In practice that means your bookkeeper enters bills, builds the payment run and files it all; you approve the run, release it, and you keep the bank credentials that allow a payment to leave. The reconciliation is either done by your accounting firm or done by the bookkeeper and reviewed by you against a statement you received directly from the bank.
Three rules do most of the work at this scale:
- Nobody sets up a payee and pays it alone. New vendors, new employees, and any change to existing banking details are approved by a second person, always, at any dollar amount.
- Statements come to the owner untouched. A read-only bank login in your name, or statements delivered to an inbox only you control, is the single cheapest control in this article. If every number you check has passed through the person you are checking, you are not checking anything.
- The person who posts does not sign off the close. Someone else reconciles, or someone else reviews the reconciliation. That second look is the whole point of a month-end close and the reason we treat the close as a control activity rather than paperwork.
The mechanics of the payment run itself are worth setting out properly, because that is where the money actually leaves. We cover the initiate, approve, release split in how to prevent payment and approval errors, and the specific checks an approver should run in what to review before approving a large payment.
Compensating controls for when you truly cannot split the work
When one person has to do everything, you replace separation with visibility and evidence. That is what auditors call a compensating control, and it is a perfectly legitimate answer at this size, provided somebody actually performs the review rather than intending to. The list below is ordered by how much protection you get for the effort:
- Owner review of a monthly exception list. Five minutes, once a month, on a page that shows only: new vendors added, any vendor banking detail changed, manual journal entries, credits and write-offs, payroll changes, payments to new or unusual payees, and round-dollar payments. Nothing normal appears on it, so nothing normal wastes your time.
- Dual authorization at the bank above a threshold you set, configured in the bank platform rather than agreed informally. A control that lives in the system cannot be skipped on a busy Friday.
- No shared logins, and the audit trail switched on. Every entry should be attributable to a named user, and deletion should be impossible: corrections happen by reversing entry, not by making history disappear.
- Role permissions in the accounting software. Most cloud systems let you separate who can create a payee, who can approve, and who can pay. The default setup usually gives everyone everything, so this is a configuration job that pays for itself once.
- Rotation and real vacations. A finance role nobody else has ever covered is a risk on its own. Someone else running the payment cycle for two weeks a year finds things.
- An outside reconciliation. The most complete substitute: your accounting firm reconciles every balance-sheet account monthly, holds no custody and approves nothing, and reports what it found. It is independence bought by the month.
None of these stop a determined person on their own. Together they make a problem short-lived instead of permanent, which is the realistic goal, and each of them belongs on the same monthly risk review as cash, receivables and margin.
Where an outside finance function does the separating for you
The structural fix at this size is to move recording and review outside the business entirely. When an outside team runs full-cycle accounting, the people posting your transactions and reconciling your accounts hold no cash, sign no cheques and approve no purchases, so the separation you cannot staff internally comes built in. Your team keeps custody and authorization, which is where an owner wants control anyway.
That is the practical shape of an outsourced finance and accounting department for an established business in Ontario: transactions processed through the month, a close that reconciles and locks the period, management reporting with commentary on what moved, a compliance calendar owned by the same team so filings never depend on one person remembering, and tax planning and advisory scheduled rather than improvised. The control benefit is a by-product of the design, but it is often the one owners notice first, because the exception list arrives whether or not anyone asked for it.
It also fixes the succession problem. When the finance function lives in one employee, their resignation is an operational event: nobody knows the filing frequencies, the bank rules or where the working papers are. When it lives in a firm, continuity is somebody else's responsibility. That is the core of an Ongoing Financial Partnership, and the reason books, payroll, filings and reporting sit together inside End-to-End Accounting rather than being split across providers.
What changes the answer for your business
How far you need to go depends on a handful of facts, and they are worth naming before you redesign anything:
- How many people can move money. One person with a bank token is a different problem than four people with cards and e-transfer rights.
- The payment rails you use. Wires and e-transfers are effectively irreversible and deserve the strictest approval; pre-authorized debits and cheques leave more time and more evidence.
- Whether you handle cash or inventory. Physical custody adds a whole second control problem: counts, variance review and someone independent doing them.
- Payroll size and who can add an employee. The ability to create a person and pay them is the single most valuable permission in your system.
- Entity and account count. Holding companies, related companies and intercompany transfers multiply both the reconciliations and the places a misposting hides.
- Whether the owner is in the business daily. An absent or semi-retired owner needs the formal version of every control listed above, because informal oversight is doing none of the work.
- Outside requirements. Lender covenants, franchise agreements, grant funding or a coming sale process all raise the evidence standard, because someone else will eventually test it.
A sensible first move is to write your current state on one page: for each of the four jobs, name the person who has it today. Most owners find one name repeated three or four times, and the fix becomes obvious the moment it is written down. If you want a second pair of eyes on that page, or you want the recording and review side handled by a team that does it for a living, a free 15-minute discovery call is the fastest way to find out what it would take.
The point is not to build a bureaucracy around a nine-person company. It is to make sure that no single absence, error or bad month can move money without anyone else seeing it. That is achievable with two people, a read-only login and a monthly review that takes less time than reading this page.
