Find the duties no one should combine
Assign finance duties to the people on your team and see each conflicting combination, with a compensating control.
Tick each duty a person can perform today, in practice or by system access. Rename the columns if it helps; names stay in your browser.
| Duty | |||
|---|---|---|---|
| Create or change vendors, including bank details Purchase to pay | |||
| Approve vendor invoices for payment Purchase to pay | |||
| Release payments in the bank portal or sign checks Cash and banking | |||
| Reconcile bank accounts Cash and banking | |||
| Create customer invoices Order to cash | |||
| Issue credit memos and write off receivables Order to cash | |||
| Receive customer payments and apply them to accounts Order to cash | |||
| Add employees or change pay rates and bank details Payroll | |||
| Run payroll and approve the payroll register Payroll | |||
| Post manual journal entries Record to report | |||
| Approve manual journal entries Record to report | |||
| Grant or change user access in finance systems System access |
Tick some duties to see conflicts.
Nothing you enter leaves this page.
Map permissions, not job titles
Allow about fifteen minutes with your system user lists open. The finder runs entirely in your browser and stores nothing.
Add everyone who can touch money
Include part-time staff, owners who hold bank logins, an outside bookkeeper, payroll provider users, and any AI agent or service account that can post, approve or pay. Roles or initials work as well as names.
Tick what each one can do
Base every tick on the permissions held in the accounting system, the bank portal and payroll, not on the job description. If someone can do it, tick it, even if they never do.
Review each conflict
For every person holding a conflicting pair, the finder shows what could go wrong and one compensating control sized for a small team.
Decide and write it down
For each conflict, remove a permission, add the compensating control, or accept the risk in writing with a named owner. Then save the result yourself, by print or screenshot, because closing the page clears it.
What counts as a conflict here
The finder covers 12 common finance duties across purchase to pay, cash and banking, order to cash, payroll, record to report and system access. It flags a conflict whenever one person holds both duties in a pair that, together, would let them start or change a transaction, push it through and keep it out of anyone else's sight. The pairs follow the classic separation of four functions: authorizing a transaction, holding the asset, recording it, and reconciling or reviewing it.
Permissions matter more than habits
Errors and fraud use the access a person has, not the tasks they usually do. A payables clerk who has never edited a vendor's bank details, but whose role allows it, holds that duty for this purpose. Pull the user and role reports from each system before you start.
Agents and service accounts are users
An AI agent that codes invoices, or an integration that posts journal entries, holds duties exactly as a person does. If its service account can also approve, it can approve its own work. The illustrative scenario the agent that approved itself shows how that happens without anyone deciding it should.
What a compensating control needs
A compensating control works only when someone independent of the conflict performs it, on a fixed schedule, and leaves evidence: a signed report, a logged bank approval, a dated review note. Reviewing a report you are able to edit does not count.
The pairs are a common baseline, not a complete rule set for every business. To work through a real example, read segregation of duties when your finance team is three people. For a full access review and redesigned approval flows, see Segregation of Duties & Approval Design.
Where small teams get stuck
We have three people in finance. Can we remove every conflict?
Usually not, and that is acceptable if the remaining conflicts are covered. Remove the most dangerous combinations first, such as vendor setup with payment release and posting with approving journal entries. Cover the rest with reviews by an owner or board member who holds no conflicting access.
Should the owner or CEO be included?
Yes. Owners often hold bank administrator rights and approve payments, which puts them on the map. Including them is not an accusation. It shows where the owner is the control and where the owner is the exposure.
What about our outside bookkeeper or payroll provider?
Include any outside user with access to your systems. Their permissions count the same as an employee's, and access granted during setup is often broader than the work needs and never reduced.
Is anything I enter stored?
No. The finder runs entirely in your browser and stores nothing on our servers or on your device. Names and ticks disappear when you close or reload the page.
Is a compensating control as good as splitting the duty?
Not quite. Splitting a duty prevents the problem, while most compensating controls detect it afterwards. Detection is acceptable when the review runs on time, the reviewer is independent and someone acts on what is found.
Does a clean result mean our controls are fine?
It means the duties you ticked do not combine into a listed conflict. It does not show whether approvals actually happen, or whether the permissions you entered match what the systems allow.
Test the map against real access
We compare user permissions in your accounting system, bank portal and payroll with who should hold them, then redesign approvals to fit your team.