Finance Ethics
Menu

No one should approve their own work

We map access against duties, remove conflicts and design approval limits that fit a small finance team.

Start a conversationTry the SoD conflict finder
Part of
Financial Process & Controls
Runs as
5 stages, from extract and map to train and hand over
You receive
6 deliverables, listed below
Pricing
Quoted after a scoping call

Access piles up, rarely comes off

Access gets added when someone needs it and rarely removed when they stop. The AP specialist who covered payroll during a vacancy still has payroll administrator rights. The controller who set up the bank portal remains its only administrator and can also approve wires. The approval policy says purchases above $10,000 need the CFO, but the accounting system enforces nothing beyond the AP clerk's own entry.

Each of these opens a specific path. A user who can create a vendor and approve its invoices can pay a company that does not exist. A user who can post and approve journal entries can move results between periods without anyone seeing the entry before close. Segregation of duties work closes those paths in the systems themselves, not only in the policy.

Engraving of two hands each holding half of a split key before a door frame with a magenta keyhole plate.
One key, two keepers.

Every user, role and threshold examined

  • Accounting system roles

    User-by-permission listings from QuickBooks Online, Xero, NetSuite, Sage Intacct or Business Central, including custom roles and dormant users who still have access.

  • Bank and payment platforms

    Portal administrators, payment initiators and releasers, dual-release settings, and who can add or edit payees.

  • Payroll and HR systems

    Who can add employees, change pay rates or bank details, and approve a payroll run.

  • The approval matrix

    Current limits for purchase orders, invoices, contracts, journal entries, credit memos and write-offs, compared with how approvals actually route in the system.

  • Service accounts and AI tools

    Integrations, bots and AI agents that post or approve transactions, treated as users with duties of their own.

  • Compensating controls

    Reviews and reports that stand in where a small team cannot split every conflicting duty.

Your team keeps every artifact

DeliverableWhat it isWhen
Duty and access mapMatrix of every user against the duties their system rights allow, with conflicting pairs highlightedWeek 2
Conflict registerSpreadsheet of each conflict with its risk, a recommended fix and a decision field for managementWeek 3
Approval matrixDelegation of authority by transaction type and amount, ready for board or owner approvalWeek 5
Role design and configuration listTarget roles for each system, with the exact permission changes your administrator or vendor will makeWeek 5
Compensating control runbookWho reviews which report, how often, and what evidence each review leavesWeek 7
Access review procedureQuarterly user-access review steps and template, run once with your team before handoverWeek 8

Eight weeks from export to handover

  1. Weeks 1 to 2

    Extract and map

    We pull user and role listings from each system and map them to the duties people actually perform, confirmed in short interviews.

  2. Weeks 2 to 3

    Analyze conflicts

    We identify conflicting combinations and test the ledger for whether any were used, such as invoices approved by the person who created the vendor.

  3. Weeks 3 to 5

    Design roles and limits

    We draft target roles and the approval matrix, then agree the changes with management and the system owners.

  4. Weeks 5 to 7

    Implement and verify

    Your administrator or system partner applies the role changes from our configuration list. We confirm each change in a fresh access export.

  5. Week 8

    Train and hand over

    We run the first access review with your team, brief approvers on the new matrix and hand over the runbook.

Exports and time we will request

  • User and role exports from the accounting system, bank portals and payroll provider
  • Your current approval policy or delegation of authority, even if informal or out of date
  • An organization chart and a list of who performs each finance task today
  • A system administrator's time during weeks 5 to 7 to make configuration changes
  • About an hour a week from the controller or CFO to decide on conflicts and limits

Is this the right fit?

A good fit

  • Finance teams of two to fifteen people where some duties overlap by necessity
  • Companies that have changed accounting systems or added a bank, payroll provider or AP tool
  • Organizations whose auditor or lender has raised findings on access or approvals
  • Companies introducing AI tools or bots that post or approve transactions

Not the right fit

  • Large ERP environments with thousands of users and custom roles, where a dedicated access-governance tool is the right answer
  • Teams that want a conflict list without changing anything; the free conflict finder may be enough

Some duty pairs should never meet

Not every overlap is dangerous. A person who enters invoices and also counts the petty cash box creates little risk. The pairs below are the ones we treat as conflicts in nearly every company, because together they let one person move money and hide it.

  • Vendor setup and payment release. One person could create a vendor, attach their own bank account and pay it.
  • Journal entry posting and approval. Entries could change results with no one seeing them before close.
  • Payroll changes and payroll approval. A raise or a ghost employee could be added and paid in the same run.
  • Cash receipts and customer credits. A payment could be pocketed and the customer's balance cleared with a credit memo.
  • Bank reconciliation and payment initiation. The person who would notice an odd payment is the one who made it.

The segregation-of-duties conflict finder lets you check your own team against these pairs before we start.

Approval limits should follow exposure

An approval matrix states how much risk each person may accept on the company's behalf. We draft it by transaction type: purchase orders, invoices without a PO, contracts, journal entries, credit memos, write-offs, payroll changes and wires. For each, it names the limit, the approver, the system where approval is recorded and the stand-in when the approver is away.

Two rules belong in every matrix. New payees and changes to payee bank details need approval from someone outside accounts payable, whatever the amount. And no one approves a transaction they initiated, including the CEO.

When the team is too small

Where a duty cannot be separated, a compensating control watches it instead:

  • A monthly report of vendor master changes, reviewed and signed by the CFO or owner
  • A bank rule that holds any payment above $25,000 until a second person releases it
  • A list of journal entries posted outside business hours, reviewed before close
  • An alert when anyone edits their own employee record

Each compensating control needs an owner, a frequency and evidence. We write those into the runbook and test the first cycle with you. If you would rather the reports run themselves, continuous controls monitoring can take them over. For a longer treatment, read segregation of duties when your finance team is three people.

What people ask before hiring us

Our finance team is three people. Is segregation of duties even possible?

Full separation usually is not, and we will not pretend otherwise. The goal is that no one person can start, approve and conceal a transaction alone. With three people that typically means splitting vendor setup from payment release, giving an owner or board member a monthly review of key reports, and using bank rules that require a second approver above a threshold.

Will you change our system settings?

We prepare the exact list of changes and verify them afterward, but your administrator or system partner makes them. Control of your systems stays with you, and you keep a record of who changed what.

How do you set approval limits?

By risk, not seniority. We look at transaction volumes and sizes in your ledger, how often each approval level is actually exercised, and where an error or loss would hurt most. The aim is fewer levels, with stricter rules for new payees and bank changes.

How do AI agents fit into segregation of duties?

As users. An AI agent or integration that codes invoices should not also hold approval rights, and its service account appears in the access map like anyone else's. We set an amount above which a person must approve, and check that the agent's actions are logged.

Also in Financial Process & Controls

Design, test and repair the controls over how money moves through your company, sized for a small finance team and checked against the ledger rather than a questionnaire.

  • Controls Health Check

    A three-to-four-week diagnostic of your core money flows that ranks every control gap by consequence and hands you a fix list your team can act on.

  • SOX & ICFR Readiness

    A ten-to-sixteen-week project that scopes your significant accounts, documents processes and controls, fixes design gaps and dry-runs testing so management's first 404(a) assessment holds up.

Related work and reading

Services

  • AI Governance for Finance

    An inventory of every AI tool and agent touching finance, a usable AI policy, and controls that treat agents as users, mapped to COSO's 2026 guidance, NIST AI RMF and ISO/IEC 42001.

  • Continuous Controls Monitoring

    Automated tests on your ledger, bank and access data every week or month, each exception reviewed by a person and routed to a named owner, run as a subscription after a six-week setup.

Articles and scenarios

Sectors

Tell us what you are seeing

A first conversation is a scoping call: what worries you, what you need to show, and to whom. You leave it with a view on where to start, whether or not you hire us.

Start a conversation
Writehello@financeethics.com
Call(307) 365-5252
Office7124 Commons Dr, Cheyenne, WY 82009
HoursMonday to Friday, 9:00 to 17:00 Mountain Time