Segregation of duties compliance means splitting financial responsibilities so no single person can initiate, approve, record, and conceal the same transaction. For public companies, the Sarbanes-Oxley Act turns that principle into a legal obligation: management must assess these internal controls every year, and officers who knowingly certify false reports face fines up to $5 million and 20 years in prison.1Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports Private companies meet similar expectations through SOC 2, PCI DSS, and NIST frameworks that treat duty separation as a baseline security control.
The Four Functions That Have to Stay in Different Hands
Effective duty separation rests on keeping four activities apart:
- Authorization: formally approving a transaction or change, such as signing a purchase order or setting a customer’s credit limit.
- Custody: physical or digital access to assets, whether cash, inventory, or credentials for sensitive accounts.
- Recordkeeping: entering transactions into the general ledger or maintaining the accounting records.
- Reconciliation: comparing independent records against the actual assets on hand to catch discrepancies.
The logic is simple. When one person authorizes a payment and also records it, they can invent a transaction and make the books agree with the invention. Add custody of the asset, and the same person can walk away with the money. An independent reconciler is what surfaces the gap between what the records claim and what is actually there. Collapse any two of these functions into one role, and the person holding both can move a transaction through its entire lifecycle without another set of eyes.
IT Administrators and Software Developers Count Too
A common gap is treating segregation of duties as an accounting problem when the same logic applies to system access. Someone who can both define user permissions and assign those permissions to themselves can grant super-user access to any account, bypassing every other control the organization has built. The person who configures the security roles in an ERP system should never be someone who also processes payments, records journal entries, or approves vendor invoices inside that system.
The same rule extends to software development. Developers who write code should not be the same people who push that code into production. Direct developer access to production systems lets someone bypass testing, alter financial data, or introduce backdoors without review. A compliant workflow typically requires a developer to commit code to a branch, have peers who did not write it review and approve the merge, run automated tests in staging, and pass a separate change-control approval before an automation tool (not a human) deploys the change. When emergency access is truly needed, a break-glass account handles it with automatic alerts and an audit trail so the exception gets reviewed after the fact.
High-Risk Duty Conflicts Auditors Look For First
Not every overlap is equally dangerous. A handful of pairings account for a disproportionate share of documented fraud, and experienced auditors go after them first.
Vendor Master File and Payment Approval
Letting one person create or modify vendor records and also approve payments is the most dangerous single combination in many organizations. The scheme writes itself: set up a fictitious vendor, route payments to a personal account, and approve those payments. A variation changes a legitimate vendor’s banking details to divert one or two payments before restoring the real information. Governments that reported vendor-related payment losses to the Washington State Auditor’s Office lost $6.8 million to schemes of this kind since 2021. The fix: the person who maintains vendor records never approves payments, and any change to vendor banking information requires independent verification.
Payroll and HR Data Entry
When one person manages employee records and also processes payroll, ghost employees become possible. The Association of Certified Fraud Examiners has reported that payroll schemes contribute to an estimated 5% of annual revenue lost to fraud across organizations worldwide. A payroll manager who takes over HR entry during a busy period can add a fictitious employee with direct deposit to a personal account and remove the record months later. Data entry, payment run approval, and adding employees to the HR system should each sit with different people.
Ordering Inventory and Confirming Receipt
An employee who both orders inventory and records its receipt can authorize inflated purchases from a favored supplier, confirm goods that never arrived, or skim physical stock and adjust records to match. The standard defense is a three-way match: purchase order, receiving report, and vendor invoice each come from a different person before payment is released.
Mapping Who Can Do What: The SoD Matrix
The practical starting point is figuring out what your people can actually do in your systems, which is often not what their job descriptions say they should do. Pull three data sets: job descriptions that define intended responsibilities, org charts that show reporting lines, and user access lists exported from every ERP and financial system that show real permissions. The gap between “should” and “can” is where conflicts hide.
Plot functional duties on one axis (approve purchase orders, create vendors, process payments, record journal entries) and user IDs or role groups on the other. Wherever a single user or role sits at the intersection of two incompatible functions, flag the cell. A well-organized spreadsheet works for smaller organizations. What matters is coverage of every transaction code and permission in the financial system, not just the obvious ones.
Then cross-reference each flagged conflict against actual transaction data. A user who technically has permission to both record sales and approve credit memos, but has never touched the credit memo function, presents a lower immediate risk than someone exercising both permissions daily. Both need remediation; the active one goes first.
Access Controls That Keep the Matrix Clean
Role-Based Access and Least Privilege
Role-based access control attaches permissions to defined roles rather than individual users. Each role bundles only what a specific job function needs. When someone changes positions, you swap their role assignment rather than editing dozens of individual permissions. If two roles conflict by design, the system can prevent anyone from holding both at once.
Layer least privilege on top: every user gets the minimum access required for their job and nothing more.2NIST Computer Security Resource Center. Glossary – Least Privilege Permission creep is what breaks this over time. Employees accumulate access through temporary project assignments, lateral moves, and system migrations, and a long-tenured employee can end up with a permission set that reads like a compliance violation waiting to be caught.
Periodic Entitlement Reviews
Schedule access reviews around your reporting deadlines. During each review, department managers confirm that every permission assigned to their staff is still necessary and document each decision (keep, revoke, modify) with the reviewer’s identity, the action, and a timestamp. That documentation becomes audit evidence. External auditors want to see not just that roles were designed correctly once, but that you are actively watching for drift.
Automated Conflict Detection
Governance, risk, and compliance tools can monitor conflicts across multiple applications in real time and flag the moment an access change creates a new conflict, rather than waiting for the next quarterly cycle. More advanced platforms analyze transaction patterns for anomalies that suggest an existing conflict is being exploited, such as an unusual volume of credit memos from a user who also records sales. Audit documentation standards expect records detailed enough to show the purpose of each control, the source of the data, and the conclusions reached.3Public Company Accounting Oversight Board. AS 1215 – Audit Documentation
What SOX Requires of the Company and Its Officers
Two sections of Sarbanes-Oxley drive most compliance work at public companies. Section 404 requires every annual report to include management’s assessment of internal controls over financial reporting, evaluating their effectiveness as of the fiscal year-end.4Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls For larger filers, a registered public accounting firm must independently attest to that assessment.5U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting Requirements Smaller issuers that don’t qualify as accelerated filers are exempt from the auditor attestation, though they still owe the management assessment.
Section 302 adds personal accountability. The CEO and CFO must certify in every annual and quarterly report that they reviewed the filing, that it contains no material misstatements, and that the financial statements fairly present the company’s condition. They must also confirm that they designed and evaluated the internal controls, disclosed any significant deficiencies or material weaknesses to the auditors and audit committee, and flagged fraud involving anyone with a significant role in internal controls.6Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports That personal certification is what gives duty separation its teeth. Officers cannot claim ignorance when they have signed their names to the effectiveness of the controls they were supposed to be evaluating.
Compensating Controls for Smaller Teams
A five-person accounting department cannot split every function across different employees the way a Fortune 500 can. Auditors accept compensating controls when true separation is impractical, but the compensating controls have to be real, not theoretical.
The most common compensating control is direct managerial review. If one person handles both vendor setup and payment processing because no one else has the skills, a manager reviews and approves every payment before it goes out with documented sign-off. The key word is documented. A manager who glances at a batch without signing anything isn’t a control. That’s hope.
Other approaches auditors generally accept: independent reconciliation by someone outside the transaction flow, periodic surprise audits by an outside party, mandatory vacation policies that force someone else to cover the role temporarily (which is when many frauds surface), and detailed exception reports reviewed by management. The thread running through all of them is that someone independent verifies the work of the person holding conflicting duties, and there is a paper trail proving it happened.
Beyond SOX: SOC 2, PCI DSS, and NIST
Duty separation is not only a public-company issue. Private companies and technology firms encounter it through other frameworks.
SOC 2 audits evaluate controls against trust services criteria, and segregation of duties runs through several of them: organizational structure and reporting lines, fraud risk assessment (which specifically examines privileged access abuse), and access control (which requires that access is authorized, modified, and removed based on roles, least privilege, and duty separation).
PCI DSS, which governs organizations that process payment card data, expects security and audit functions to operate independently from operational functions handling cardholder data.
Federal agencies and their contractors face NIST SP 800-53, which includes control AC-5 addressing separation of duties. Organizations subject to it must identify and document duties that need separation and define system access authorizations that enforce it. Any company selling to the federal government or handling controlled unclassified information is likely inside that scope.
Penalties When Compliance Fails
Criminal Liability for Officers
SOX Section 906 imposes criminal penalties on officers who certify financial reports they know to be inaccurate. Knowing certification of a report that does not comply with SOX carries up to $1 million in fines and 10 years in prison. Willful certification, meaning the officer knew the report was misleading and signed anyway, jumps to $5 million and 20 years.1Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports When duty-separation failures enable wire fraud schemes, the underlying fraud itself carries up to 20 years, or 30 years if it affects a financial institution.7Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
SEC Enforcement Without an Underlying Fraud
The SEC has pursued companies for internal control failures even without evidence of underlying fraud. In a 2019 enforcement action, the SEC charged four public companies with longstanding failures to maintain effective internal controls over financial reporting. Civil penalties ranged from $35,000 to $200,000 per company, and some were required to retain independent consultants to remediate their material weaknesses. The agency stated that disclosing a material weakness is not enough; meaningful remediation is expected.8U.S. Securities and Exchange Commission. SEC Charges Four Public Companies With Longstanding ICFR Failures
Material Weakness Disclosures
When auditors identify a material weakness, defined as a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be caught in time, the company must disclose it in the annual filing.9Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting The disclosure carries its own consequences: investor confidence erodes, stock prices often fall on the announcement, and audit fees rise in subsequent years. Weaknesses that persist across multiple reporting periods draw the kind of SEC attention described above.
Section 302 requires officers to disclose material weaknesses to the auditors and audit committee.6Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports An officer who knows about a duty-separation breakdown and hides it from the audit committee is not just missing a compliance checkbox. They are personally exposed to the criminal penalties in Section 906. Duty separation protects the organization from fraud, and it protects the people signing the reports from personal liability.