Separation of duties means no single person controls a transaction from start to finish. One person makes the entry and another approves it. One person handles the money and another records it.
It is the oldest and most effective control in accounting. It matters even with five staff, because small teams give each person a lot of trust and power.
Why one person doing every step is a risk
Picture one person who can add a supplier, change the supplier’s bank account, enter a bill and approve the payment. That person can invent a supplier and pay themselves. Nothing in the process will show it.
Take away any one of those powers and a second person must be involved. That makes fraud harder and riskier. It also catches honest errors, such as a wrong amount, a duplicate bill or a payment to the wrong account.
The aim is not paperwork. It is to make sure at least two people see every important action.
Four jobs to keep apart
Any process has four jobs. Ideally no one person does more than one of them for the same transaction.
- Approving: deciding something should happen, such as a purchase, a refund or a pay rise.
- Holding: handling the cash, stock or bank account.
- Recording: entering it in the books.
- Checking: comparing the records with reality, independently.
Which pairs to split first
With few people, start where the loss could be largest.
Money going out
- The person who adds a supplier or changes their bank details should not approve payments to that supplier.
- The person who enters a bill should not release the payment.
- Confirm any change of supplier bank details through a second channel, such as a call to a known number. Changed bank details are a classic fraud method.
Cash and the till
- The cashier who sells should not count the till at the end of the shift.
- The person who banks the cash should not be the only one who records the deposit.
- Voids, refunds and discounts above a limit need a second person. See spotting cashier voids and discount abuse.
Stock
- The person who receives goods should not enter the supplier bill.
- A stock adjustment needs a reason, and a second person above a set limit. The person who adjusts should not be the one who counts.
- A stock count should be done by someone who does not look after the stock.
Payroll
- The person who prepares payroll should not approve it.
- New staff, pay changes and bank detail changes should be approved by someone other than the person who entered them, before payroll is approved.
- Someone other than the preparer should compare what was paid with the bank.
The books
- A manual journal entry should be approved by someone other than its author.
- The person who posts to the books should not be the only one who checks the bank.
- Reopen a closed month only with approval and a recorded reason.
Access and approvals
- The person who gives system access should not be the one who uses the most powerful permissions without review. Check regularly who has wide access.
- Make approval limits step up with the amount. Small items go to a supervisor, larger to a manager, the largest to the owner.
When you cannot split a job
In a very small business, the owner may be the only second person. Use these extra checks instead:
- The owner reads a short list of exceptions each week: the largest adjustments, voids, payments and manual journals.
- The owner checks the bank and mobile-money statements personally, or an outside accountant does.
- The owner approves supplier bank changes and payroll directly.
- An accountant or trusted adviser checks a sample of transactions each quarter.
- Rotate duties and require leave where possible. Fraud that needs one person present every day often shows up when that person is away.
Make the system enforce it
A rule that lives only on paper gets skipped when staff are busy. Your system should enforce it:
- Require a reason for voids, refunds, discounts, price changes and stock adjustments.
- Record the maker and approver separately. Refuse an approval by the same person where the rule applies.
- Set approval limits by amount, action and branch.
- Lock records once posted, so a correction is a visible reversal and not an edit.
- Keep a log of who did what that nobody can edit.
If the system allows exceptions, for example in a very small team, it should report them and not hide them.
Check that it works
A control you never test may not exist. Each month:
- List records where maker and approver are the same person. Ask why.
- List who has wide access. Ask if they still need it.
- Look for odd timing: approvals at night, back-dated entries, changes just before payroll.
- Check that approvals are really read. An approval clicked in one second is not a control.
- Look for split sales or payments just under an approval limit.
Tell staff why
The rule works best when you explain it as protection. Anyone can make a mistake. A clean process protects honest people from suspicion.
Apply it to everyone, including senior staff and yourself. And make approving easy, such as a reply on a phone. A control that is painful gets bypassed.
How software can help
Ziira records who made and who approved each record. It supports approval limits by amount and action. It locks posted records and keeps the log of who did what.
Ziira Intelligence checks the exceptions every day:
- Approvals decided by the person who asked.
- Someone given wide access.
- Activity outside working hours.
- Manual journals made and approved by the same person.
- Payroll pay terms approved by the person they benefit.
These are flags to ask about, not accusations. For how access is controlled, see the security and privacy summary.
Split the steps, make the second person real, and look at the exceptions regularly. Most of the benefit comes from that simple habit.