Segregation of Duties in a Small Team: Practical Setup

Segregation of duties is the practice of splitting a money task so that no one person can approve a payment, make it, record it and check it. In a small team you will not get textbook separation, but you can get close: the owner keeps approval and bank review, staff handle the day-to-day processing, and an outside bookkeeper or a few simple compensating controls cover the gaps. This guide shows how to assign duties with two, five or ten people, which combinations are dangerous, and how to fit the controls around your invoicing and payment process.

It matters because small businesses are hit hard by internal fraud. The Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations analyzed 2,402 cases and found a median loss of $104,000 per case, with organizations of fewer than 100 employees reporting a median loss of $126,000, higher than any other size group. Small firms also have fewer anti-fraud controls in place, so schemes run longer before anyone notices.

What is segregation of duties?

Every financial transaction passes through four kinds of activity. Segregation of duties (often shortened to SoD) assigns them to different people:

• Authorization: deciding a transaction should happen, such as approving a vendor invoice, a refund, a pay rise or a customer credit.
• Custody: physical or electronic access to the asset, such as signing checks, releasing bank transfers, handling cash or holding inventory.
• Recording: entering the transaction in the accounting system, creating invoices, posting payments and adjusting balances.
• Reconciliation and review: comparing the records against something independent, such as the bank statement, a vendor statement or a stock count.

The principle is simple: if one person can do two of these steps on the same transaction, especially custody plus recording, they can both take money and hide it. Splitting the steps means a theft or a mistake needs either collusion or will be visible to the next person in the chain. Segregation of duties is one piece of a wider system of internal controls, alongside approvals, documentation and a reliable audit trail.

Segregation of duties matrix for a small business

The table below shows a practical split for the money flows most small businesses have. Use it as a starting point and adjust names to your team.

Process	Authorize	Custody / execute	Record	Review / reconcile
Paying vendor bills	Owner or manager approves the bill	Owner releases payment (or second approver in bank)	Bookkeeper or admin enters bill	Owner reviews bank statement; bookkeeper reconciles
Adding or changing vendors	Owner approves new vendor and bank details	Admin sets up vendor in system	System log records change	Owner reviews vendor change report monthly
Customer invoicing	Manager confirms work done and price	n/a	Admin creates and sends invoice	Owner reviews aged receivables
Receiving customer payments	n/a	Payments go straight to bank or processor; mail opened by someone outside bookkeeping	Bookkeeper applies payments to invoices	Owner compares deposits to sales report
Credit notes and write-offs	Owner approves every credit or write-off	n/a	Bookkeeper posts it	Owner reviews list of credits monthly
Payroll	Owner approves hires, pay rates, bank changes	Payroll provider pays staff	Admin enters hours	Owner reviews payroll register each run
Petty cash	Manager approves spending	Custodian holds the cash	Custodian logs receipts	Someone else counts cash at random

For petty cash specifically, a simple petty cash log with receipts and surprise counts covers most of the risk.

Dangerous combinations to avoid

If you only fix a few things, fix these pairings. Each one lets a single person both move money and conceal it:

1. Vendor setup plus payment approval. This is how fake vendor and billing schemes work. Someone creates a vendor, sends invoices from it and approves them. Our vendor onboarding checklist explains how to verify a new supplier before the first payment.
2. Bank detail changes plus payment release. Changing a vendor's or employee's bank account is the most sensitive edit in your system. Require a call-back to a known phone number and a second person to approve the change.
3. Receiving payments plus recording customer balances. A person who handles incoming checks and also posts receipts can pocket a payment and hide it with a credit note or by applying a later customer's payment to the earlier invoice (lapping).
4. Signing checks plus reconciling the bank. Whoever reconciles should not be the person who writes or signs checks, otherwise altered or unauthorized checks never surface.
5. Running payroll plus approving payroll changes. Ghost employees and inflated hours depend on this combination.

How to segregate duties when you only have 1-3 people

With a very small team, the owner is the control. The goal is not that everyone does one job, but that the owner holds the high-risk steps and looks at independent evidence regularly.

Owner plus one employee

• The employee prepares invoices, enters bills and applies customer payments.
• Only the owner can approve bills, release payments, add vendors, change bank details, approve credit notes and sign checks.
• The owner downloads the bank statement directly from the bank (not from the employee) and scans it each month.
• An outside bookkeeper or accountant reconciles the accounts quarterly or monthly.

Owner plus a part-time bookkeeper

• The bookkeeper records and reconciles, but has view-only bank access with no ability to send payments.
• The owner approves and releases all payments in online banking.
• The owner reviews the bank reconciliation and asks about any old reconciling items. If you are unsure who should do what, our comparison of a bookkeeper vs accountant helps.

Teams of 5-10

Now you can split more cleanly: an office manager handles invoicing and receivables, a second person enters payables, the owner or a finance lead approves and pays, and an outside accountant reviews. Rotate tasks occasionally and require people to take their full vacation; schemes that need daily maintenance tend to surface when the person is away.

Compensating controls when you cannot split a task

When separation is impossible, add a check that would catch a problem after the fact:

• Owner statement review: read every bank and business card statement monthly, looking for unknown payees, round-number transfers and payments just under your approval limit.
• Monthly bank reconciliation done or reviewed by someone who cannot move money.
• Dual control in online banking: one user creates a payment, another approves it.
• Positive pay on any account that issues checks, so the bank only clears checks that match your issued list.
• System audit logs: review who created vendors, edited invoices or deleted transactions.
• Duplicate checks: run a report for duplicate invoice numbers and amounts; our guide to duplicate invoice payments lists the patterns to search for.
• Surprise reviews: occasional unannounced cash counts or vendor statement comparisons.

Step by step: setting up segregation of duties in a week

1. List your money flows. Customer invoicing and receipts, vendor payments, payroll, card spending, petty cash and refunds.
2. Write down who does each step today. Use the four columns: authorize, custody, record, review.
3. Highlight conflicts. Mark any row where the same person has custody plus recording, or setup plus approval.
4. Move the high-risk steps to the owner or a second person. Start with payment release, vendor setup and bank detail changes.
5. Configure software permissions. Give each person their own login and the narrowest role that lets them work. Turn on dual approval in banking.
6. Define approval limits. For example, bills under $500 approved by a manager, anything above by the owner. Document this in an invoice approval workflow.
7. Schedule reviews. Put the monthly statement review and reconciliation sign-off in the calendar.
8. Revisit after changes. New hires, departures and new software all reshape who can do what.

Worked example: a 4-person design studio

This is an illustrative example. A studio bills about $40,000 a month. Before the review, the office manager created client invoices, received check payments by mail, deposited them, entered payments in the accounting software, paid vendor bills from the shared bank login and reconciled the bank. The owner looked at the profit and loss report once a quarter.

That set-up lets one person hold custody, recording and review at the same time. If the office manager deposited a $3,200 client check into a personal account and marked the invoice as paid with a credit note, nobody would see it until a client complained, which may never happen.

After the review:

• Clients pay by bank transfer or card link; checks go to a bank lockbox, so no one handles paper checks.
• The office manager still creates invoices and applies payments, but cannot issue credit notes over $0 without owner approval.
• The office manager can create vendor bills; the owner approves and releases every payment from her own banking login.
• An outside bookkeeper reconciles the bank monthly for about $300 a month and sends the owner a one-page summary, including a list of credit notes and new vendors.
• The owner spends 20 minutes a month reading the bank statement and the receivables aging report.

The cost is a few hundred dollars a month and a little owner time. Against a typical small-business fraud loss measured in six figures, it is cheap insurance.

Common mistakes

• Shared logins. If three people use one banking or accounting password, the audit trail cannot show who did what.
• Trusting the long-serving employee. Many frauds are committed by trusted staff with years of service. Controls are not an accusation; they protect honest people too.
• Owner signs without looking. A second signature only works if the approver actually reads the invoice and checks the vendor.
• Reviewing reports produced by the person being reviewed. Pull bank statements directly from the bank.
• Ignoring credit notes and write-offs. These are favorite tools for hiding stolen receipts. Our invoice scam warning signs guide covers the outside threats; credits cover the inside ones.

Where invoicing fits in

Clean invoicing makes segregation of duties much easier to check. Use sequential invoice numbers so gaps and duplicates stand out, keep a copy of every invoice and credit note, and make sure customer payment details on invoices point to the business bank account only. A fixed format and consistent numbering, for example from our invoice number generator, let the reviewer compare the sales list against deposits in minutes.

Ready to tighten your billing records? Create numbered, professional invoices with our free invoice generator: no sign-up, and every invoice downloads as a PDF you can file for review and reconciliation.