Segregation of Duties: Conflicts, Small Entities and Testing

Segregation of duties means no one person controls a transaction from start to finish. When the steps are split between people, one person's error or fraud is more likely to be caught by someone else.

The four duties to separate

Duty	Examples
Authorization	Approving purchase orders, payments, journal entries, new vendors
Custody	Handling cash, signing cheques, releasing payments, holding inventory
Recording	Posting invoices and journal entries, maintaining the vendor master file
Reconciliation and review	Bank reconciliations, comparing subledgers to the GL, reviewing reports

The main conflict is one person holding custody of an asset and also recording it. That person could take the asset and hide it in the records.

Common conflicts by process

Process	Conflict	What could go wrong
Purchases and payables	Same person sets up vendors and approves payments	Payments to a fake vendor
Cash receipts	Same person opens mail, deposits cash and posts to receivables	Taking a receipt and hiding it with a credit note
Payroll	Same person adds employees and runs payroll	Pay to a ghost employee
General ledger	Same person posts and approves journal entries	Unsupported entries that change results
Bank	Same person releases payments and reconciles the bank	Unauthorized payments that never show up as reconciling items
IT	Developers can change production systems	Unauthorized changes to how transactions are processed

Small entities

A business with three people in finance cannot separate everything. Compensating controls reduce the risk:

• The owner approves every payment and signs every cheque.
• The owner gets the bank statement directly and reviews it.
• Someone independent reviews the bank reconciliation and the journal entry listing each month.
• The system blocks the person who sets up vendors from releasing payments.

Auditors look for these and test them as part of the control environment.

How auditors test it

1. Understand who does what, through walkthroughs and the entity's job descriptions.
2. Get the user access listing from the accounting system and check roles against the duties people should have. Look for users with both vendor setup and payment rights, or both posting and approval rights.
3. Test transactions. In journal entry testing, look for entries posted and approved by the same user, or posted by people who shouldn't post at all.
4. Test the compensating controls when duties are not separated.

A segregation of duties weakness raises control risk. See our guide to the audit risk model.

Where Warp Accounting fits

Warp Accounting's journal entry testing applies the firm's criteria to every entry in the journal, including who posted it, and returns the flagged entries in a working paper. Its controls testing checks each sampled transaction for the approval the firm specifies, with each result linked to the evidence. See journal entry testing, controls testing and our guide to the test of controls.