Segregation of Duties on a Small Finance Team: A Practical Guide
The control every small company struggles with
Segregation of duties (SoD) is a foundational internal control: no single person should control a transaction end to end. The classic conflicts are letting one person both create a vendor and pay it, or both record cash and reconcile the bank. Concentrate those and you’ve created the conditions for fraud and for undetected error.
It’s also the control small companies find nearly impossible, because SoD assumes you have enough people to divide the work. When finance is one or two people, textbook segregation simply isn’t available.
Start with the incompatible pairs
You don’t need to separate everything — you need to separate the combinations that matter. The high-risk pairs to break up first:
- Create/approve a vendor and pay a vendor.
- Record cash receipts and reconcile the bank.
- Approve payroll changes and run payroll.
- Post journal entries and approve them.
- Custody of an asset and the records for that asset.
If you can’t split every one of these across people, split the ones with a direct path to cash first.
When you can’t separate, compensate
The COSO framework — the reference internal-control model behind most audits — treats control activities as one of five components, and it explicitly contemplates compensating controls when a primary control isn’t feasible. For a small team, compensating controls are how you get real assurance without more headcount:
- Owner or manager review of bank reconciliations, new vendors, and payments over a threshold — with a record that the review happened.
- System-enforced approvals so a payment can’t be released without a second set of eyes.
- After-the-fact monitoring that flags conflicts and exceptions someone then reviews.
- A clear audit trail so every action is attributable to a person.
Auditors accept compensating controls; what they can’t accept is a gap with nothing covering it.
Make the invisible visible
The hardest part of SoD at small scale is simply seeing the conflicts. Access grows organically — someone gets admin rights to fix an urgent problem and keeps them for two years. Periodically (or continuously) reviewing who can do what, and where incompatible permissions overlap, is the control behind the control. It’s also one of the first things an IT general controls review examines.
The practical takeaway
Small teams can have genuinely strong control environments — not by pretending they have big-company staffing, but by targeting the incompatible pairs, layering review and system approvals where separation isn’t possible, and keeping a clean, attributable audit trail. Done right, it satisfies auditors and closes the gaps fraudsters look for.