What is segregation of duties? How to split finance tasks when your team is small

When the auditors of an agricultural equipment distributor in Pekanbaru send their management letter, one finding is marked high priority. The senior AP officer, nine years in the job and trusted by everyone, can create a vendor, change its bank account, enter its invoices and prepare the payment file. The director who releases payments in internet banking does it from the officer’s list, usually from a phone between meetings, and the same officer reconciles the bank account at month-end.

The auditors found nothing wrong. That was the finding: if something had been wrong, nothing in the company’s records would have shown it.

Segregation of duties is the control that closes this gap. This guide covers what it means, which duties to keep apart, a worked example of splitting them in a finance team of four, what to do when a small team can’t separate everything and how to set it up.

What is segregation of duties?

Segregation of duties (SoD) means dividing the steps of a transaction between different people, so that no one person can make a mistake or commit a fraud and also hide it. Every transaction has four kinds of duty, and the classic rule is that one person shouldn’t hold two of them:

• Authorising: approving the request, the purchase order, the invoice or the payment.
• Custody: control of the money or the asset itself, such as releasing payments in internet banking or holding the petty cash.
• Recording: entering the transaction in the books, or changing the master data behind it, such as a vendor’s bank account.
• Reconciling: checking the records against an independent source, such as the bank statement.

It’s related to, but not the same as, your approval matrix. The matrix says who may approve what. Segregation of duties says which tasks the same person must never combine, whatever their authority. You’ll also hear it called the four-eyes principle, or maker-checker: one person prepares, another checks.

The duties to keep apart

These are the combinations auditors look for first in purchasing, payments and expenses:

• Creating vendors and paying them. Whoever adds a vendor or changes its bank account shouldn’t approve its invoices or prepare its payments. Otherwise one person can set up a vendor and pay it. This is why vendor onboarding needs a second person.
• Requesting and approving. Nobody approves their own purchase request or expense claim, including senior managers.
• Approving and paying. The person who approves an invoice or a payment run isn’t the one who releases the money.
• Preparing and releasing a payment run. One person builds the payment run, someone else approves and releases it.
• Paying and reconciling. The person who makes payments shouldn’t be the one who checks them against the bank statement, or a payment nobody approved can stay hidden.
• Receiving and approving the invoice. The warehouse confirms what arrived and AP matches the invoice to it, so the person who signs for the goods doesn’t also approve the bill.
• Holding cash and recording it. Whoever holds the petty cash box doesn’t also keep its book or count it at month-end.

A worked example: splitting duties in a team of four

The Pekanbaru distributor’s finance team is four people: a finance manager, the AP officer, a cash and receivables officer and an accountant. The AP officer handles about 260 vendor invoices a month, worth around Rp 3.8 billion. The director’s internet banking token for urgent payments had been kept in the AP officer’s drawer for years.

Before changing anything, the finance manager checked the riskiest thing the officer could do alone: the 14 vendor bank account changes made in the past year, after which those vendors had been paid Rp 1,126,400,000. Each change was traced to a letter on the vendor’s letterhead and confirmed by phone, on a number from the original vendor file. It took two days, and every change was genuine. Then the duties were split:

Duty	Before	After
Create a vendor, change bank details	AP officer	Procurement, approved by the finance manager
Enter and match invoices	AP officer	AP officer
Prepare the payment run	AP officer	AP officer
Approve the payment run	Nobody	Finance manager
Release payments in the bank	Director, from AP’s list	Director, from the approved run
Reconcile the bank account	AP officer	Cash officer
Review vendor and bank changes	Nobody	Finance manager, monthly

Nobody was hired, and the AP officer kept all of the work that needs AP skills. Two duties moved and two checks were added:

• Vendor changes left AP. Procurement now enters new vendors and bank changes, and the finance manager approves them after a call-back. The AP officer can no longer change who gets paid.
• The payment run is approved before it’s released. The finance manager approves the run as a whole, and the director releases that run, not a list. The token went back to the director, and a second director was set up in the bank as the backup releaser for leave.
• The bank reconciliation moved to someone who doesn’t pay. The cash officer compares every payment on the statement with the approved runs, so a payment nobody approved would surface within a month.
• Vendor changes are reviewed every month. The finance manager looks through a list of every new vendor and bank change, and next year’s check takes an hour instead of two days.

Why segregation of duties breaks down

• Small teams. Four people can’t cover every combination, so some duties have to sit together.
• Leave and cover. The backup is given full access for two weeks and keeps it for two years.
• Access only grows. People change roles and keep their old access, so long-serving staff end up able to do everything.
• Shared logins and tokens. A shared admin login, or a director’s token in someone else’s drawer, means nobody can tell who did what.
• Administrators and owners. They can do everything, and nobody reviews what they do.
• Urgent payments. The emergency payment skips every step, and nothing records that it did.
• Self-approval by the back door. A manager’s own claim is submitted by an assistant and approved by the manager, as the assistant’s approver.
• The rule is in the policy, not in the system. The document says one person can’t create and pay a vendor, but the system lets them.

When you can’t separate: compensating controls

In a small team, some duties will stay together. When they do, add a compensating control: a check by someone else, often after the fact, that would catch what the missing separation lets through.

• Review the master data. A monthly list of new vendors and bank changes, reviewed by someone who didn’t make them.
• Read the exception reports. Payments to new vendors, payments to accounts changed recently, self-approved items and payments outside the run, each reviewed monthly by a named person.
• Let the bank do the separating. Most corporate internet banking lets you set up separate maker, approver and releaser roles, each with its own login and token.
• Send the bank statement to a director. A director who sees the statement directly, not through finance, notices a payment nobody mentioned.
• Rotate and take leave. Someone else doing the job for two weeks a year finds what doesn’t add up.
• Keep a log nobody can edit. An audit trail that records who did what and when, so a review after the fact has something to review.

Segregation of duties in Indonesia

• The anggaran dasar and the directors. The articles of association (anggaran dasar) set who can represent the company, and can require Board of Commissioners (Dewan Komisaris) approval for some transactions. Make sure the people who release payments, and the limits in your approval matrix, match what it says.
• Internet banking roles and tokens. Set up separate maker, approver and releaser roles in your corporate internet banking, and give each token to one named person. A token that sits in a drawer, or that a director hands to staff, undoes the separation the bank provides.
• Family-owned businesses. When the owner or a family member does much of the finance work, the strongest compensating control is usually the owner reviewing the bank statement and the vendor changes in person, every month.
• Listed companies. Listed companies (Tbk) are required to have an audit committee and an internal audit unit, and both will test segregation of duties. Expect them to ask for evidence, not just a policy.
• Personal data. Expense claims and vendor files hold personal data, such as employees’ bank accounts and identity numbers, which UU PDP protects. Limit who can see them by role, as part of the same exercise.

Signs your segregation of duties needs work

You probably need to look at how duties are split if any of these sound familiar:

• One person can create a vendor and also pay it.
• Someone in finance can approve their own expense claims.
• An internet banking token is shared, or kept by someone other than its owner.
• The person who makes payments also reconciles the bank account.
• Nobody reviews changes to vendor bank details.
• People who changed roles still have their old access.
• Urgent payments skip approval and leave no record.
• Your segregation rules exist in the policy document, but not in the system.

Segregation of duties doesn’t assume anyone is dishonest; it makes sure an honest team can prove it.

How to set up segregation of duties

1. List the duties. For purchasing, payments, expenses and cash, write down who requests, approves, records, pays and reconciles.
2. Map who can actually do what. From system and bank access, not from job descriptions. Include admin logins, tokens and backups.
3. Mark the conflicts. Check each person against the combinations above.
4. Move what you can. Often without hiring: vendor changes to procurement or the finance manager, the bank reconciliation to someone who doesn’t pay.
5. Compensate for the rest. For each conflict you keep, name the review, the report it uses, who does it and how often.
6. Put the rules in the system. Configure roles so conflicting duties are blocked, not just discouraged, and replace shared logins with personal ones.
7. Plan for leave. Name backups who don’t create new conflicts, and remove their access when the cover ends.
8. Review access regularly. Every quarter, for example, and whenever someone joins, changes role or leaves.

---

How Procapy helps

In Procapy, segregation of duties is a configuration rule, not a reminder in a policy document. Who can create, who can approve, who can release payment and who can change vendor bank details are separate roles, and the system prevents the same person from holding conflicting ones on a single transaction. A requester can never be their own final approver, and ProcApprove blocks self-approval, circular chains and single-person payment paths when the chains are configured. The person who creates a vendor can’t approve its invoices, and any change to a vendor’s bank details needs a separate approval by someone other than the person who made it.

In Proca to Pay, the bank account on each payment is checked against the verified vendor master before the payment file is generated, a payment to an account that changed after the invoice was approved is held until the change is approved, and payment release requires dual authorisation. In Capy Expense, nobody can approve their own claim. Proca Agents act only within the authority you set, and payment release stays with the people in your approval matrix.

Every action is logged with who did it and when, in an audit trail that nobody, including an administrator, can edit. The role configuration and every change to it sit in the same log, so you can show the control existed, not only that it was intended. Overrides are recorded with the name and the reason, exception reports cover anything self-approved and auditors can have their own read-only access. Most teams are live in under two weeks. The fraud and risk and audit pages cover the controls in more detail. Book a 30-minute walkthrough, bring your delegation-of-authority policy, and we’ll configure the first approval chain live.