One person, one Thursday, four duties
On an illustrative Thursday afternoon, the AP specialist is out sick, a new supplier's invoice for $14,200 is due, and the controller wants to keep the relationship on good terms. So she adds the supplier to the ERP, types in the bank details from the supplier's email, approves the bill and releases the ACH payment from the bank portal before 5:00 p.m. Nothing about this is dishonest. It is also the exact sequence a fraud would need: one person created the payee, decided where the money went, approved the obligation and moved the cash.
Every small finance team has days like this. The textbook answer, more people, is not available. The workable answer has three parts: decide in advance which duties must never sit with one person on the same transaction, bring one person from outside the team into the design, and let the bank and the ERP enforce the split so it does not depend on goodwill on a busy Thursday.
Small teams carry more risk
The ACFE's Occupational Fraud 2026 report, built on 2,402 cases from 143 countries and territories, found that organizations with fewer than 100 employees had the highest median loss of any size band, at $126,000. Billing schemes appeared in 28% of small-business cases against 18% at larger organizations, and check and payment tampering in 18% against 8%. Those are the schemes that segregation of duties exists to stop.
The same report found that the primary weakness behind a fraud was a lack of internal controls in 33% of cases, an override of existing controls in 19% and a lack of management review in 18%. Management review was in place at 41% of the small businesses in the study, against 79% of larger ones. A three-person team cannot fix its headcount. It can fix review.
COSO's framework allows for exactly this. Its executive summary says segregation of duties is typically built into control activities, and that "where segregation of duties is not practical, management selects and develops alternative control activities." The point is to choose those alternatives on purpose and write them down, rather than discover after the fact that nobody was looking.
Separate access, not job titles
Think of every money process as four kinds of access:
- Change: create or edit master data, such as a vendor's bank account, an employee's pay rate or a customer's credit limit.
- Approve: authorize the obligation, such as a bill, a credit memo or a journal entry.
- Move: initiate or release money in the bank portal or the payroll system.
- Check: reconcile the result against an independent record, such as the bank statement.
A conflict exists when one person holds two of these for the same transaction and nobody else sees it. Change plus move is the most dangerous pair, because it lets one person redirect a real payment to a new account. Approve plus check is the quietest, because the person who should catch the problem is the person who caused it.
A duty split for three people
The matrix assumes a controller, an AP and AR specialist and a staff accountant, plus the owner, CEO or a board treasurer with narrow rights. The $25,000 threshold is an example. Set yours where a single bad payment would hurt but routine work still flows.
| Duty | Controller | AP and AR specialist | Staff accountant | Owner or CEO |
|---|---|---|---|---|
| Add or change a vendor, including bank details | Approves after callback | Enters | View only | Reviews weekly change report |
| Enter and code bills | View only | Enters | No access | No access |
| Approve bills | Up to $25,000 | No | No | Above $25,000 |
| Build ACH or wire batches in the bank | No | Builds | No | No |
| Release payments in the bank | Releases batches built by others | No | No | Second release above $25,000 |
| Apply customer receipts | View only | Applies | No | No |
| Credit memos and write-offs | Approves | Prepares | No | Reviews quarterly list |
| Post manual journal entries | Posts close entries | No | Posts | No |
| Review journal entries | Reviews staff entries | No | No | Reviews controller's entries monthly |
| Reconcile bank accounts | Reviews and signs | No | Prepares | Reads statements directly |
| Payroll rate or bank changes | Approves | No | Enters | Reviews register each run |
| Administer bank and ERP users | No | No | No | Holds admin rights |
Read the matrix across, then down. Across, no row gives one person both change and move. Down, the specialist can enter almost everything but approve and release nothing. The controller approves and releases but cannot create a payee or build a batch. The staff accountant posts and reconciles but cannot pay anyone. The owner's column is short on purpose: a few minutes a week of second releases and reviews, plus administrator rights nobody else holds, so no one inside the team can grant themselves access.
Let the bank enforce the split
Business banking portals commonly offer the settings below. Ask your treasury management contact which ones your package includes and what they cost, since several are often included.
- Dual control on ACH and wires. One user initiates, a different user approves. The portal, not a policy, stops a user from approving their own batch.
- Per-user and per-transaction limits. The controller can release up to $25,000; anything larger needs the owner's second release.
- Template-only payments. Money can go only to saved payees, and adding or editing a payee needs a second approver. This closes the route of typing a new account into a free-form wire.
- Dual administration. Adding a user or raising a limit needs two administrators.
- Alerts to the owner. New payee, changed payee, new user, changed limit and any wire above a set amount.
- Positive pay and ACH debit filters. Checks and debits that do not match what you issued or authorized are held for a decision.
- Read-only access for the owner or treasurer. Statements viewed directly in the bank cannot be edited on the way to the reviewer.
Let the ERP enforce it too
Permission settings in the accounting system do the same work on the recording side. In QuickBooks Online Advanced, for example, custom roles set access separately for vendors, bills, bill payments, banking and journal entries, with actions such as view, create, edit, approve and pay. NetSuite, Sage Intacct and Microsoft Dynamics 365 Business Central support similar splits through roles and permission sets.
- Give the specialist create and edit rights on bills and vendors, with no approve or pay rights.
- Turn on bill approval workflows above your threshold, routed to the controller or the owner.
- Lock closed periods so posted months cannot change without a permission the staff accountant does not hold.
- Keep the audit trail on and read it. Vendor changes, deleted transactions and journal entries by user are the three reports that matter most.
Reviews close what settings cannot
Some gaps survive good settings. The controller posts close entries and reviews everyone else's, so someone must look at hers. Three reviews cover most of what remains:
- Weekly vendor change report, reviewed by the controller and initialed by the owner, with callback evidence attached to every bank change. The verification steps are set out in vendor bank-change fraud: five controls that stop it.
- Monthly journal entry listing by user, reviewed by the owner or an outside accountant, with attention to entries the controller posted and entries posted after the close.
- Quarterly access review. Export users and roles from the ERP, the bank portal and the payroll system, and compare them line by line with the matrix. Remove anything that crept in since the last review.
Evidence makes a review count
A review that leaves no trace did not happen, as far as an auditor, a lender or a buyer is concerned. Each control above should produce something you can hand over: a change report initialed and dated, an approval log in the ERP, a release history in the bank portal, an access export with changes marked. Keep them in one folder per month. When the team grows to five people, most of these controls stay in place. They simply move to someone else's column.
Where to start
Map current access before redesigning anything. Export the users and roles from your bank portal and your ERP, mark each person's change, approve, move and check rights, and run the result through the free segregation-of-duties conflict finder. If the list of conflicts runs longer than a page, segregation of duties and approval design covers redrawing the matrix, configuring the permissions and writing the compensating reviews into a runbook.