Segregation of Duties in Accounts Payable: Designing Controls for Small Finance Teams

The Policy That Describes a Company You Don’t Have

Most finance functions have a segregation of duties policy. It describes a clean separation: one person raises, another approves, a third pays, a fourth reconciles.

Then look at the system. The finance manager has permission to add a vendor, post an invoice, approve it under a threshold and release the payment run — not because anyone decided that, but because access accumulated over four years of covering absences, absorbing a departed colleague’s work, and being granted rights during a system migration that were never withdrawn.

The policy is accurate as a statement of intent. It is fiction as a statement of capability.

This gap is where most segregation of duties failures live. Not in an absence of policy, but in the distance between the documented design and what the system actually permits — a distance nobody measures until an auditor extracts a user permissions report.

What Is Segregation of Duties?

Segregation of duties is a preventive control ensuring that no single individual controls all stages of a transaction. It rests on separating four functions that are incompatible when combined.

The underlying logic is that combining any two of these lets one person both act and conceal. Someone who can move money and record the entry can disguise where it went. Someone who can approve a payment and reconcile the bank account can approve something improper and ensure the reconciliation never surfaces it.

Crucially, this is not primarily about distrusting people. Segregation catches honest error as effectively as deliberate misuse. A miskeyed bank account is caught by the same independent check that would catch a fraudulent one.

Which Conflicts Matter Most in Accounts Payable?

Not all conflicts carry equal risk, and treating them as equivalent wastes effort on low-severity issues while leaving serious ones unaddressed.

The conflict most organisations under-rate

Vendor master maintenance combined with payment execution deserves particular attention because it is both the most dangerous and the most frequently overlooked.

Discussion of AP controls tends to focus on invoice approval, which feels like the decisive moment. But approval controls assume the payee is legitimate. If one person can add a supplier and also release payments, the approval step protects nothing — the transaction can look entirely ordinary, with a plausible invoice, a correct-looking supplier, and an approval that was genuinely given by someone who had no reason to question a vendor already sitting in the master file.

This is why vendor master change control is a segregation issue rather than a data quality issue. Related mechanics are covered in automated vendor validation and vendor bank account errors and payment failures.

How Do You Build a Segregation of Duties Matrix?

A duties matrix maps roles against system functions and states which combinations are prohibited. It is what turns an abstract principle into something you can provision access against and test.

1. Inventory the functions, not the job titles. List the discrete system capabilities that matter: create vendor, amend vendor bank details, enter invoice, approve invoice under threshold, approve above threshold, create payment run, release payment run, post journals, perform bank reconciliation, amend approval workflows, manage user access.

2. Map who currently holds each. Extract this from the systems, not from an organisation chart. This step routinely produces surprises.

3. Classify each pairing. Permitted, permitted with a compensating control, or prohibited. Base severity on what the combination enables, using something like the table above.

4. Identify the conflicts you cannot remove. In a small team there will be some. Record them explicitly rather than quietly ignoring them.

5. Design compensating controls for each. Specific, assigned, and evidenced.

6. Re-provision access to match. The matrix has no effect until permissions reflect it.

7. Review on a defined cadence — and always on role change.

Include one function that is frequently omitted: the ability to change the approval workflow itself. Someone who can edit approval rules can route transactions to themselves or lower a threshold, which undermines every other control. That capability belongs with a small, separately controlled group.

What Do You Do When You Cannot Separate the Duties?

This is the situation most finance teams are actually in, and where generic guidance becomes unhelpful. A four-person finance function cannot separate every incompatible pair. The answer is not to pretend otherwise.

Acknowledge and document the conflict. An auditor finding an undocumented conflict draws very different conclusions from one finding a documented conflict with designed compensating controls. The first suggests you do not know your control environment; the second suggests you manage it.

Then apply compensating controls that are genuinely performed:

Independent review of the payment run. Someone outside the payment process reviews the full listing against supporting documents before release, with particular attention to new payees and changed bank details. This is the single most effective compensating control for a small team.

Dual authorisation above a threshold. Two approvers for payments above a defined value, ideally enforced by the banking platform as well as the finance system.

Independent bank reconciliation. Whoever else does what, the person reconciling the bank should not be the person releasing payments. If necessary this can sit with someone outside finance entirely — an owner, director or external accountant.

Management review of vendor master changes. A periodic report of new and amended vendor records, reviewed by someone who cannot make those changes. Short, high-value, and easily evidenced.

Mandatory leave and rotation. A long-standing control precisely because ongoing concealment usually requires continuous presence.

Systematic exception review. Duplicate detection, anomaly alerting and out-of-pattern flags provide detective cover where preventive separation is not achievable. See AP anomaly detection for multi-entity finance teams and preventing duplicate invoices and payments.

The essential discipline: a compensating control that is documented but not consistently performed is worse than none, because it creates false assurance. If the payment run review happens only when someone is not busy, it is not a control.

How Does Segregation of Duties Relate to Delegation of Authority?

They are complementary and frequently confused.

Delegation of authority answers how much someone may approve — value bands by role, category and entity, with escalation above thresholds.

Segregation of duties answers which functions one person may combine — whether an approver may also record or pay.

A well-designed delegation schedule with no segregation lets an authorised approver also execute the payment. Strong segregation with no delegation schedule leaves nobody clear on who may approve what. Both are required.

A practical delegation schedule specifies the value band, the role authorised, whether dual approval applies, and the escalation route. It should be version-controlled, and changes to it should themselves require approval — a control point often missed.

How Does Automation Strengthen AP Controls?

Automation improves segregation in three specific ways, provided the configuration is deliberate.

Rules are enforced rather than remembered. A system-enforced control applies to every transaction, including at month end when everyone is under pressure — which is exactly when manual controls are most often skipped.

Evidence is generated automatically. Every action carries a user, timestamp and record. This is materially stronger audit evidence than retrospective attestation, and it costs nothing to produce.

Roles become explicit. Configuring an approval workflow forces decisions about who may do what that are otherwise left ambiguous.

There is a genuine risk to manage: automation can weaken control if access defaults are broad, if automated steps obscure accountability, or if administrator rights sit with the same people who process transactions. Control design has to be explicit rather than inherited from a default configuration. Our human-in-the-loop AI finance governance framework covers where human judgement must remain accountable in automated workflows.

How Does Peakflo Support Segregation of Duties in AP?

Peakflo enforces control design in the system rather than leaving it to policy adherence.

Granular role-based permissions. Capabilities are assigned individually — creating vendors, amending bank details, entering invoices, approving by threshold, releasing payments, editing workflows — so incompatible functions can be genuinely separated rather than bundled into coarse roles.

Controlled vendor master changes. Changes to supplier banking and registration details are routed for independent verification and fully logged, addressing the critical conflict directly. The vendor portal lets suppliers maintain their own details through a controlled, auditable path rather than by emailing a request someone actions manually, while vendor onboarding applies validation at the point of entry.

Threshold-based approval with dual authorisation. Approval workflow automation applies delegation of authority as configured rules, including mandatory second approval above defined values, by category and entity.

Enforced separation between approval and payment. End-to-end payment automation keeps payment release as a distinct permission from invoice approval, so the final check before funds move remains independent.

Complete, immutable audit trail. Every action — entry, approval, amendment, vendor change, payment release, override and its justification — is logged with user and timestamp, giving auditors contemporaneous evidence rather than reconstruction.

Detective controls alongside preventive ones. Duplicate detection and anomaly alerting provide cover where full separation is not achievable, which matters most for small teams.

Multi-entity role separation. Permissions are scoped per entity, so a shared services team can support several companies without any one person holding conflicting rights across all of them. See our multi-entity AP automation guide.

Our Verdict: How Much Control Design Does Your Team Need?

Invest in formal segregation when:

• Anyone can both maintain vendor records and release payments
• You are audited, or expect to be, or are approaching a financing event
• Payment volumes or values have grown materially without a control review
• Access rights have never been reviewed against a duties matrix
• Your finance team has grown, so separation is now feasible but was never implemented
• You operate multiple entities with shared finance staff
• Approval workflow configuration is not itself access-controlled

A lighter, documented approach is defensible when:

• The team is genuinely too small for meaningful separation, and this is documented
• Owner or director involvement provides real independent oversight
• Payment volumes and values are low
• Compensating controls are in place and consistently evidenced

The realistic position for most growing finance teams is that full textbook segregation is unattainable and that is acceptable — provided the gaps are known, documented and compensated. What is not acceptable is a policy asserting separation that the system contradicts, because that combines the cost of having controls with the exposure of not having them, plus the audit finding that follows.

Conclusion

Segregation of duties tends to be treated as a documentation exercise: write the policy, file it, produce it when asked. But the control does not live in the document. It lives in system permissions, and permissions drift — accumulating quietly through role changes, absence cover and temporary access that outlives its purpose.

The most valuable thing most finance teams can do is stop reviewing the policy and start extracting the permissions. Who can create a vendor? Who can release a payment? Who appears on both lists? That single query surfaces more real control risk than a full policy rewrite.

From there the work is honest rather than aspirational. Build a matrix of functions and prohibited combinations. Re-provision access to match it. Identify the conflicts you cannot remove given your team size, document them explicitly, and design compensating controls that someone is actually accountable for performing and evidencing.

Automation helps not because it replaces judgement but because it enforces the design consistently and records what happened — turning controls that depend on people remembering into controls that apply by default, with the audit evidence produced as a by-product.

Request a demo to see how Peakflo enforces role separation, vendor change control and approval thresholds across accounts payable.

Frequently Asked Questions

What is segregation of duties?

Segregation of duties is a control principle requiring that no single person controls all stages of a transaction. It separates four incompatible functions: authorising a transaction, holding custody of the resulting assets, recording the transaction, and reconciling the records. The purpose is to ensure that an error or a deliberate misuse requires more than one person to occur and pass unnoticed.

What are the four incompatible duties?

Authorisation, meaning approving that a transaction should happen. Custody, meaning control over the asset, most importantly the ability to move money. Recording, meaning entering the transaction into the accounting records. Reconciliation, meaning independently checking that records agree with external evidence such as bank statements. Combining any two of these in one person creates a control conflict of varying severity.

What is the most serious segregation of duties conflict in accounts payable?

The ability to create or amend a vendor record combined with the ability to execute payments. That combination allows one person to add a payee and pay it without any independent check, which is the mechanism behind most significant payment fraud. It is more serious than the more frequently discussed conflict between entering and approving invoices.

What is a segregation of duties matrix?

A segregation of duties matrix maps roles or individuals against system functions and identifies which combinations are prohibited. It is typically presented as a grid where each cell shows whether holding two functions together is acceptable, acceptable with a compensating control, or prohibited. It becomes the reference point for provisioning system access and for audit testing.

How do small finance teams achieve segregation of duties?

Often they cannot achieve full separation, and pretending otherwise is worse than acknowledging it. The recognised approach is to identify which conflicts are unavoidable, document them explicitly, and implement compensating controls such as independent review of payment runs, management review of vendor changes, mandatory dual authorisation for payments above a threshold, and independent bank reconciliation.

What is a compensating control?

A compensating control is an alternative control introduced where the preferred control is not feasible. If one person must both record and pay because of team size, compensating controls might include a manager reviewing the full payment listing against supporting documents before release, someone independent performing the bank reconciliation, and system alerts on new payee creation. It must be documented, performed consistently and evidenced.

What is delegation of authority and how does it relate to segregation of duties?

Delegation of authority defines who may approve what, usually by value band, category and entity. Segregation of duties defines which combinations of functions one person may hold. They are complementary: delegation answers whether this person may approve this amount, while segregation answers whether the person approving should also be able to record it or pay it. Both are needed.

How does segregation of duties differ from fraud detection?

Segregation of duties is preventive control design that makes certain misuse structurally difficult by ensuring more than one person is required. Fraud detection is the identification of suspicious activity after or as it occurs, through anomaly analysis, duplicate checks and exception review. Strong organisations use both, because control design cannot eliminate collusion and detection alone does not prevent anything.

Why does system access review matter for segregation of duties?

Because segregation exists in practice only as far as system permissions enforce it. Access rights accumulate as people change roles, cover absences or assist temporarily, and elevated access granted for a short-term need is rarely withdrawn. Periodic access review against the duties matrix is what keeps documented control design aligned with actual system capability.

Does automation improve or weaken segregation of duties?

It generally strengthens it, provided controls are configured deliberately. Automation enforces rules consistently rather than relying on individuals remembering them, and produces a complete log of who did what and when. The risk is that a poorly configured system grants broad access by default, or that automated steps obscure who is accountable for a decision, so control design must be explicit rather than assumed.

How do you test that segregation of duties is working?

Test the system rather than the policy document. Extract actual user permissions and compare them against the duties matrix to find conflicts. Sample transactions and verify that the person who approved was not the person who recorded or paid. Review who created or amended vendor records and whether those people can also release payments. Testing the policy tells you what was intended, not what is possible.

What evidence do auditors expect for segregation of duties?

Typically a documented duties matrix, a current delegation of authority schedule, evidence of periodic user access review with exceptions followed up, system logs showing approvals performed by appropriately authorised individuals, and documented compensating controls with evidence they were performed where full separation is not achievable. Contemporaneous system logs are considerably stronger evidence than retrospective attestation.