Segregation of Duties and the Internal Control Matrix Explained

Segregation of duties and the internal control matrix work as a pair: the first is the rule that no single employee should control a financial transaction from beginning to end, and the second is the grid you use to check whether the rule is actually holding. Split every process across four functions, put them in different hands, then map who can do what so you can see the overlaps before an auditor or a thief does. For public companies, this isn’t optional design work. The Sarbanes-Oxley Act requires CEOs and CFOs to personally certify that internal controls over financial reporting are effective in every quarterly and annual filing.¹

The Four Functions That Have to Stay in Different Hands

Effective segregation breaks every financial process into four functions, and the goal is simple: no employee should hold more than one of them for the same transaction.

Authorization is approving a transaction before it happens, such as signing off on a purchase order or approving a new vendor.
Custody is physical or electronic control of the asset, whether that means handling cash, managing inventory, or holding the checkbook.
Record-keeping is maintaining the accounting records that document the transaction in the general ledger, subledgers, or financial statements.
Reconciliation is independently verifying that records match reality, by comparing bank statements to internal ledgers or confirming inventory counts against system records.

These four work as interlocking checks. The output of one becomes independent verification of another. Separate authorization from custody and the person who approves a payment never touches the money. Separate record-keeping from reconciliation and the person who books the entry never gets to verify their own work. Committing fraud now requires at least two people to collude, which is substantially harder than one person acting alone.

Where the four collapse into one role, the math flips. If a single employee handles cash receipts and also records credits to customer accounts, they can pocket incoming payments and write off the balance as a credit adjustment without anyone noticing. The internal control matrix exists to find those collapses.

The Role Combinations That Cause the Worst Damage

Accounts Payable

The person who creates or edits vendor records should never approve payments. That combination is the textbook fictitious vendor scheme: invent a vendor, submit invoices for goods or services that were never provided, approve payment to an account you control. Separating vendor maintenance from payment authorization closes the pathway entirely.

Accounts Receivable

The employee who opens the mail and handles incoming checks must not have access to post credits or adjustments on customer accounts. When those duties overlap, the employee can intercept a customer payment and disguise the missing revenue by writing off the balance or applying it to a different account. This is called lapping, and it can run for months before anyone detects it.

Payroll

If the person who adds new employees to the HR system also processes payroll runs, they can create ghost employees and route the wages to their own bank account. The fix is straightforward. One person or department handles employee setup, a separate person authorizes and runs payroll, and someone else entirely reconciles the payroll register to actual headcount.

Inventory

The person conducting physical inventory counts should not have authority to adjust the perpetual inventory records in the accounting system. Combine those roles and the employee can steal inventory and alter the count to conceal the shortage. Organizations that can’t fully separate these duties should at minimum require secondary authorization for inventory adjustments and run surprise counts on high-value items throughout the year.

General Ledger

Manual journal entries deserve special attention because they can override the controls that apply to normal subledger activity. Employees who process routine transactions should not have the ability to post manual entries. Restrict that access to senior accounting staff, and require a second approver for entries above a dollar threshold.

IT Access Is Where Segregation Quietly Fails

The people who run your technology infrastructure can bypass every financial control you’ve built if their own access isn’t restricted. The most dangerous IT overlap is between software development and database administration. A database administrator typically has unrestricted permission to read, change, or delete anything in the production database. If that same person writes or modifies application code, they can alter programs to redirect funds or manipulate data and then erase the evidence directly from the database. These two roles need completely independent permissions with no crossover.

A similar conflict exists between IT security administration and system operations. Whoever grants user access to financial systems should not also be performing transactions in those systems. When administrators set up their own access, the segregation you’ve built for the finance team means nothing. Periodic access reviews conducted by someone outside IT are the check on this.

Building the Matrix

The matrix is a grid that maps every employee or role against every financial task they can perform. Three documents feed it, and most organizations already have them but rarely cross-reference them:

The organizational chart shows reporting lines and where supervision gaps exist.
User access reports pulled from each financial system show the permissions actually assigned to each user ID. This is the ground truth of what people can do, regardless of what their job description says.
Job descriptions document what each role is supposed to do. The gap between the description and the access is often where the problem hides.

Put employee names or job titles across the top of the grid and financial tasks down the side. Mark each cell where an employee has the ability to perform the task. Note the word “ability.” If a payroll clerk has system permission to approve payments even though their job description doesn’t include that function, the matrix should flag it. The access is the weakness whether or not the employee has ever used it.

Populating the grid means comparing user access reports against the task list line by line. It’s tedious work, and shortcuts defeat the point. An inaccurate matrix is worse than no matrix, because it creates false confidence that controls are working.

Reading the Matrix: Finding and Ranking Conflicts

Once the matrix is populated, scan for prohibited combinations: cells where one person holds marks in two or more functions that should be separated. An employee who can both create vendor records and approve payments would show marks in both rows. That horizontal pattern is the red flag.

Not every conflict carries the same weight. Auditing standards distinguish two severity levels, and the classification drives what happens next.

A material weakness is a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement in the financial statements won’t be prevented or caught in time. Material weaknesses must be disclosed publicly and typically trigger immediate remediation.²
A significant deficiency is less severe but important enough to merit attention from those overseeing financial reporting. It must be communicated to the audit committee but doesn’t require public disclosure.²

A segregation failure that would let one person both initiate and conceal a material transaction generally lands in material weakness territory. A lesser conflict in a low-volume process may be a significant deficiency. Department heads should certify that the finished matrix accurately reflects current operations and access in their areas, and the signed matrix should be archived electronically with a timestamp. For public companies, this documentation feeds directly into the management assessment required under SOX Section 404(a).³ In a restatement, regulatory inquiry, or fraud investigation, a current validated matrix is the evidence that management exercised due diligence at a specific point in time.

When You’re Too Small to Fully Separate Duties

A five-person accounting department can’t assign each of the four core functions to a different employee for every process. That doesn’t earn a pass on controls. It means management has to add compensating controls that reduce the risk the overlap creates. The workable options:

Detailed transaction review. A manager regularly reviews transaction reports for the area where duties overlap, focusing on high-dollar or unusual items and following up on anything that looks off.
Sample testing. Periodically select a sample of transactions, pull the supporting documentation, and verify each one was properly authorized and accurately recorded.
Exception reports. Run system-generated reports that flag deleted transactions, duplicate entries, or amounts above a set threshold.
Analytical review. Compare current results to budgets or prior periods and investigate significant variances. A spike in vendor payments or inventory adjustments can surface a problem that transaction-level review misses.
Reassigning reconciliation. Even when authorization and custody can’t be separated, reconciliation almost always can be given to someone else. An independent person reconciling the bank account is a meaningful check on the employee who handles deposits and record-keeping.

Compensating controls are not permanent solutions. They’re risk-reduction measures that should be revisited as headcount grows. Auditors will evaluate whether compensating controls are designed appropriately and operating effectively, so documenting what you’re doing and why matters as much as doing it.

What SOX Requires and Who Is Exempt

SOX imposes two distinct internal control obligations on public companies, and the distinction matters because not every company faces both.

Under Section 404(a), every public company must include an internal control report in its annual filing stating that management is responsible for maintaining adequate internal controls over financial reporting and containing management’s assessment of whether those controls are effective.³ No public company is exempt.

Section 404(b) adds a second layer: the external auditor must independently evaluate management’s assessment and issue its own report on the effectiveness of internal controls. This auditor attestation is significantly more expensive, and non-accelerated filers are exempt from it.³ A company generally qualifies as a non-accelerated filer if it has a public float below $75 million, or if it has a public float under $700 million combined with less than $100 million in annual revenue.⁴

Separately, Section 302 requires the CEO and CFO to personally certify in each quarterly and annual report that they have reviewed the filing, that the financial statements are not misleading, and that they have evaluated the effectiveness of internal controls within 90 days of the report date. Those certifying officers must also disclose all significant deficiencies and material weaknesses to the company’s auditors and audit committee, along with any fraud involving management or employees with a significant role in internal controls.¹

What Getting This Wrong Costs

Consequences split into criminal exposure for individuals and civil penalties for companies. Both can be severe.

Under SOX Section 906, a corporate officer who willfully certifies a financial report knowing it doesn’t comply with the Act faces up to $5 million in fines and up to 20 years in prison.⁵ The word “willfully” carries the weight. An officer who signs a certification without knowing it’s false faces lesser penalties, but one who signs knowing the controls are broken and the financials are unreliable is in felony territory.

When segregation failures enable actual fraud, other criminal statutes come into play. Wire fraud carries up to 20 years per count, rising to 30 years and $1 million in fines if the fraud affects a financial institution.⁶ Federal embezzlement from organizations receiving federal funds carries up to 10 years.⁷

On the civil side, the SEC can impose penalties for failures to maintain accurate books, records, and internal controls, with amounts scaling based on whether fraud was involved and whether the conduct caused substantial losses or produced substantial gains.⁸ Beyond fines, the SEC can seek officer-and-director bars, disgorgement, and injunctions that effectively end a career in public company management. A functioning matrix, regular access reviews, and prompt remediation of identified weaknesses put a company in a far better defensive position than one reconstructing what controls existed after something went wrong.

1
Office of the Law Revision Counsel. United States Code Title 15 – 7241 Corporate Responsibility for Financial Reports
2
Public Company Accounting Oversight Board. AS 2201 An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
3
Office of the Law Revision Counsel. United States Code Title 15 – 7262 Management Assessment of Internal Controls
4
U.S. Securities and Exchange Commission. Smaller Reporting Companies
5
Office of the Law Revision Counsel. United States Code Title 18 – 1350 Failure of Corporate Officers to Certify Financial Reports
6
Office of the Law Revision Counsel. United States Code Title 18 – 1343 Fraud by Wire, Radio, or Television
7
Office of the Law Revision Counsel. United States Code Title 18 – 666 Theft or Bribery Concerning Programs Receiving Federal Funds
8
Office of the Law Revision Counsel. United States Code Title 15 – 78u-2 Civil Remedies in Administrative Proceedings