Resources
What If One Accountant Handles the Whole Payment Process?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
That combination deserves a segregation-of-duties review, but it does not prove a loss or control failure. When one accountant enters bills, prepares payments and reconciles the bank, the same person may be able to make an error and conceal it. A small team may not be able to split every duty. Management should assess the actual access, payment-release process and risk, then choose independent checks that can prevent or promptly detect problems.
Why do small teams end up here?
Small teams combine jobs to keep work moving. There is nothing odd about that. The problem is that no one else sees the whole path. If a payment is wrong, on purpose or by mistake, the same person may be the one who would notice.
Where do I start?
Draw a one-page map of the payment process. Write who does each step. Mark every step done by the same person. Then check what the system lets people do, not just what they do now. Your system administrator can confirm the rights.
What checks can a small team add?
| Check | Who does it | Proof it leaves |
|---|---|---|
| An independent owner or senior leader reviews bank activity promptly, at a frequency matched to payment risk | Owner or senior leader | Dated review evidence showing the transactions checked and any exceptions followed up |
| An authorized independent person approves payments under defined risk and amount thresholds before release | Anyone other than the preparer | Recorded approval before release, including how exceptions or overrides were handled |
| An independent person reviews new vendors and bank-detail changes promptly, before affected payments when practical | Anyone other than the person who makes them | Dated report with investigated changes and follow-up |
| A person independent of payment preparation reviews the reconciliation within a defined period | Controller, owner or outside accountant | Signed and dated reconciliation, source bank evidence and documented resolution of exceptions |
Pick the checks that fit your volume and risk. The reviewer must see real evidence, such as the bank statement itself, not a summary from the same accountant.
What can reconciliation review catch, and what can it miss?
An independent reconciliation review is a detective check: it may reveal differences or unusual transactions after money has moved. It does not replace controls over who can add vendors, change bank details, approve payments or release funds. Management should decide whether earlier preventive checks are also needed. The reviewer should use bank-sourced evidence, investigate exceptions and document the review.
What should I write down?
Write the duties one person holds. Write why you cannot split them. Name the checks you chose, who runs them and what proof they leave. Add a date to look at it again, such as when you hire or change systems. If a check stops running, tell management.
Example (illustrative)
In a small company, Dana enters bills, prepares checks and does the bank reconciliation. The Controller cannot add a person this year. She proposes that an authorized owner approve payment batches before release, using the bank’s payment details, and that a person independent of payment preparation review the reconciliation promptly. She also arranges timely review of new vendors and bank-detail changes. Management documents the chosen checks, their timing, evidence, limitations and the date to reassess them.
Questions people ask
Do we have to hire another accountant?
Not necessarily. Other checks can lower the risk. They do not replace every missing split, so do not treat them as perfect.
What if the owner is the only other person?
The owner may serve as a reviewer if they have the authority, competence and independence needed. They should inspect bank-sourced evidence and document exceptions; a signature without review is not enough.
Does this mean something went wrong?
No. It means there is a gap to understand. Management decides what to do.
Is this the same as a user access review?
No. Segregation of duties focuses on conflicting responsibilities or access. A user access review asks whether access is appropriate more broadly.
Your next step
Draw your payment map and mark the steps one person holds. Use the free How to Check That a Control Reduces the Risk: Confirm Safeguards Worksheet to list the safeguard, its owner, who checks it, and the proof it leaves. Use the free How to Record Segregation of Duties Decisions: Keep a Record of Decisions Worksheet to record each decision, who made it and why.
Then read these articles:
- How Do I Know Whether a Control Reduces a Segregation of Duties Risk?
- What Should I Record After a Segregation of Duties Review?
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. A potential conflict does not prove fraud or a control failure.
Top internal controls and SOX education for growing companies.