Yes. Segregation of duties is one of the core internal controls recognized by the COSO framework, the dominant standard auditors use to evaluate whether a company’s controls are adequate. It sits inside the Control Activities component under Principle 10, and its purpose is simple: no single person should control every step of a financial transaction, because dividing the work turns each participant into a check on the others.
That placement is not decorative. When an auditor examines a company’s books and finds one person approving purchases, recording the payments, and holding the checkbook, the finding goes straight into a control deficiency analysis. If the gap is serious enough, it becomes a material weakness the company has to disclose publicly.
Where Segregation of Duties Sits in the COSO Framework
COSO organizes internal controls into five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities. Segregation of duties belongs to Control Activities, which covers the policies and procedures that carry out management’s directives for reducing risk. Under Principle 10, the organization is expected to select and develop control activities that reduce risk to acceptable levels, and COSO explicitly names segregation of duties as one of the factors that has to be addressed.
So the answer to whether it counts as an internal control is not a matter of opinion or best practice. It is written into the framework auditors apply. A company that ignores it is not skipping a nicety; it is failing a formal requirement of the control architecture.
The Four Functions That Must Be Separated
Segregation of duties works by dividing every financial transaction into four functions and, wherever possible, assigning each to a different person.
Authorization
Authorization is the gatekeeping function. Before money moves or a commitment is made, someone with the appropriate authority approves it. A department head signs off on a purchase order. A supervisor approves overtime before payroll runs. If the person authorizing a payment is also the one recording it or holding the cash, nothing stops them from approving fictitious expenses and pocketing the money.
Recording
Recording is entering the transaction into the accounting system once it has been authorized. The bookkeeper who keys entries into the general ledger should not be the person who approved them. Combine those two powers and one employee can authorize a payment to a vendor that does not exist, then record it as a legitimate business expense.
Custody
Custody is physical or digital control over assets: cash, inventory, equipment, or access credentials for financial systems. The employee who handles incoming checks should never also record the deposits. If they do, they can pocket a check, record a smaller deposit, and nothing surfaces unless an independent reconciliation catches it. The same logic applies in the warehouse. Whoever receives goods should not be the one recording the inventory count, because that combination lets them steal product and adjust the record to cover it.
Reconciliation
Reconciliation is the detective function. An independent person compares two separate records of the same activity to confirm they match: bank statement against cash ledger, physical inventory count against recorded balance. Whoever does this must not have participated in the authorization, recording, or custody of the transactions being reviewed. Otherwise they are checking their own work, which defeats the purpose. Monthly is the standard frequency for most organizations; high-volume businesses often reconcile weekly.
Where the Risk Concentrates
Two business processes attract more fraud than almost anything else, and both depend on proper duty separation to stay clean.
Payroll
Ghost employee fraud is the classic payroll scheme. Someone with access to both the HR system and payroll processing creates a fictitious employee, assigns them hours, and routes their pay to a bank account they control. It can go undetected for years if nobody independently reviews the payroll register against the actual workforce. Preventing it means splitting the process: one person adds new employees, another runs payroll calculations, a third authorizes the disbursement, and an independent reviewer compares the final payroll report against active employee records.
Procurement
Procurement is vulnerable to fictitious vendor schemes. If one person can both add vendors to the master file and approve payments, they can set up a shell company, submit invoices for goods never delivered, and pay themselves. The critical separations mirror the four categories: one person creates the requisition, another approves it, someone else processes the invoice and creates the payment voucher, and yet another authorizes the disbursement. The vendor master file needs its own control. Changes to a vendor’s name, address, or bank account should require approval from someone other than the person making the edit.
The Limits: Collusion and Management Override
Segregation of duties assumes each person in the chain acts independently. When two or more people conspire, they can bypass the controls entirely; the authorizer and the recorder together can create and conceal fraudulent transactions. No structural separation prevents cooperation.
This is why anonymous reporting channels matter so much as a companion control. According to the ACFE’s 2024 Report to the Nations, 43% of occupational frauds are detected through tips, more than three times the rate of any other detection method. When employees, vendors, and customers can report suspicions without fear of retaliation, colluding schemes become far riskier to sustain.
Management override is the more dangerous variant. When senior executives circumvent the controls they are supposed to enforce, the usual checks fail because those executives can suppress questions. The primary defense is the audit committee of the board, which should maintain direct relationships with internal and independent auditors, receive whistleblower complaints involving senior management without filtering, and periodically hear from employees below the executive layer.
What Small Organizations Do Instead
A 500-person company can spread the four functions across departments without difficulty. A five-person company cannot. Small businesses do not get a pass on internal controls; they use compensating controls to approximate the same protection with fewer people. Auditors expect this, and the AICPA’s practice guidance for small entities addresses it directly.
The most important compensating control is active owner or manager review. When the bookkeeper who records transactions also handles deposits, the owner should receive bank statements unopened, review them monthly, and compare cleared checks against approved invoices and the cash receipts log. Manual oversight of this kind substitutes for the structural separation that larger organizations build into their org charts. Dual check signatures above a threshold, owner sign-off on write-offs and credit memos, mandatory vacation for the bookkeeper (which forces someone else to handle the work and often surfaces irregularities), quarterly review of the vendor list, and external preparation of the financial statements by an outside CPA all serve the same purpose. None of these is as strong as true separation, but they are far better than nothing, and auditors accept them as reasonable alternatives when full separation is not feasible.
How the Law Treats It
For publicly traded companies, segregation of duties is not optional. Federal law requires management to evaluate and report on internal controls, and the consequences for getting it wrong can be severe.
Sarbanes-Oxley Section 404
Section 404 requires every public company’s annual report to include a management assessment of the internal control structure for financial reporting. Management must state that it is responsible for maintaining adequate internal controls and must evaluate whether those controls are effective as of fiscal year-end. For larger public companies, the independent auditor must also examine management’s assessment and issue its own opinion on the effectiveness of internal controls.1Office of the Law Revision Counsel. United States Code Title 15 – 7262 Management Assessment of Internal Controls
If auditors or management identify a material weakness, the company must disclose it publicly. A material weakness is a deficiency, or combination of deficiencies, serious enough that there is a reasonable possibility a material misstatement in the financial statements would not be prevented or detected in time.2U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports Inadequate segregation of duties is one of the most common findings that auditors flag as a material weakness, particularly when the same person authorizes and records transactions or handles both custody and reconciliation.
Criminal Penalties for False Certification
Section 906 of Sarbanes-Oxley created criminal penalties for executives who certify financial reports they know to be inaccurate. The CEO and CFO must personally certify that each periodic report filed with the SEC fully complies with securities law and fairly presents the company’s financial condition. If an executive knowingly certifies a false report, the penalty is a fine of up to $1 million, up to 10 years in prison, or both. If the false certification is willful, the maximum jumps to a $5 million fine, up to 20 years in prison, or both.3Office of the Law Revision Counsel. United States Code Title 18 – 1350 Failure of Corporate Officers to Certify Financial Reports
The link back to segregation of duties is direct. If a company’s controls are so weak that financial statements are materially misstated, and the CEO certifies those statements anyway, the certification itself becomes the basis for criminal liability. Ignoring known control deficiencies is not just an audit risk; it is a prison risk.
How Software Enforces It
Modern accounting systems can enforce segregation of duties automatically through role-based access control. Permissions are mapped to roles rather than individuals: the accounts payable clerk role can create payment vouchers but cannot approve them; the AP supervisor role can approve vouchers but cannot cut checks. The system physically prevents anyone from performing tasks outside their assigned role, which takes human error out of the picture.
The strongest implementations use conflict matrices that flag when a proposed role assignment would give one person access to incompatible functions. If a manager tries to grant someone both “create vendor” and “approve vendor” permissions, the system blocks it and generates an alert. For any of this to work, the underlying role design has to map the four categories correctly. A system that separates recording from authorization but gives the same role both custody and reconciliation has automated the wrong thing.
Automation does not eliminate the need for monitoring. Access rights drift as employees change positions, take on temporary duties, or accumulate permissions that no one revokes. Regular access reviews, where management compares each employee’s current permissions against their actual responsibilities, catch these creeping violations before they open exploitable gaps.
Mapping Duties Before Assigning Them
Building an effective segregation structure starts with understanding who currently does what. Management needs to inventory each employee’s actual responsibilities, not just their job description. Job descriptions lag behind reality, and the real risk lives in what people actually have access to. Pull a list of every user’s system permissions, check-signing authority, safe access, and ability to edit master files such as the vendor list or employee database.
Map each permission and responsibility to one of the four categories: authorization, recording, custody, or reconciliation. When the same person appears in two or more categories for the same transaction cycle, that is a conflict that needs resolution. Either reassign the duty, or put a compensating control in place if reassignment is not practical. Document every conflict and every compensating control in writing. Auditors will ask for this documentation, and having it ready turns a potential finding into evidence of a well-managed control environment.
The mapping exercise often turns up surprises. The accounting manager who “just helps out” with bank deposits has custody access that conflicts with their recording role. The IT administrator who can modify user permissions in the accounting system effectively holds the power to override every segregation control in the company. These overlaps are normal in organizations that grew organically, but they need to be identified and fixed before they become the mechanism for a fraud that nobody sees coming.