Resources
Can One Person Create a Vendor and Prepare Its Payment?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Often the system allows it. That is a segregation of duties question, and it deserves a look. The risk depends on what else the person can do. Can they also change bank details, approve the invoice, or release the money? Look at the whole path from new vendor to payment, not one job title.
What is segregation of duties?
Segregation of duties means no one person controls a sensitive task from start to finish. In accounts payable, the person who sets up a vendor should not also be able to send that vendor money with no one else checking. A potential conflict combination is a potential conflict. It is a reason to look closer. It is not proof of fraud.
What steps should I map?
List each step on the path. Then write who can do it today and whether a second person is involved.
| Step | Who can do it today | Is a second person involved? |
|---|---|---|
| Create a new vendor | ||
| Change vendor bank details | ||
| Enter an invoice | ||
| Approve the invoice | ||
| Prepare the payment batch | ||
| Approve and release the payment | ||
| Reconcile the bank account |
Fill in the table with the people who actually have the rights in the system. Your policy may say something different. Your system administrator can confirm the rights.
Which combination matters most?
Changing bank details is the step to watch. A person who can create a vendor, change its bank details and prepare a payment may create an opportunity for an unauthorized payment if approval, release restrictions or other independent safeguards are ineffective. Preparing a payment batch alone does not mean that person can release the money. A person who can only create the vendor, while someone else approves the invoice and Treasury releases the payment, is a different case.
What safeguards can management look at?
Here are three examples. An authorized independent person confirms bank-detail changes using a trusted contact method already on file, rather than contact details supplied in the change request. Record the confirmation and resolve exceptions before affected payments where feasible. Someone other than the preparer approves and releases every payment batch. An independent person reviews vendor and bank-detail changes at a frequency appropriate to the payment risk, with prompt follow-up on unusual changes. A monthly report alone may be too late to prevent an improper payment. A safeguard must fit the risk and must actually run. A written policy alone does not show that the check happened.
Who does what?
The accounts payable manager and the Controller judge the business risk and decide the response. Treasury owns the payment release step. IT or the system owner confirms roles and makes approved access changes.
Example (illustrative)
Sam in accounts payable can create vendors and enter invoices. A manager approves each invoice, and Treasury releases each payment. The AP manager confirms with IT that Sam cannot change bank details on an existing vendor. The AP manager documents the separation and checks whether the approvals and payment release restrictions work as described. Management then decides whether the remaining risk is acceptable. Now take Lee, who can create a vendor, change its bank details and prepare the payment batch. That needs a closer look and a safeguard.
Questions people ask
Is vendor creation plus invoice entry always a problem?
No. The whole path, who approves, and what safeguards run decide how much it matters.
Is an invoice approval enough?
Not always. Check whether someone can change vendor details or release the payment through another route.
Can I fix this by removing access?
Sometimes. Small teams cannot always split every step. Then management picks a safeguard and writes down the reason.
Is this the same as a user access review?
No. Segregation of duties focuses on conflicting responsibilities or access. A user access review asks whether access is appropriate more broadly.
Your next step
Fill in the step table for your own payment process. Use the free How to Find Conflicting Duties: Highlight Conflicts Worksheet to list the pairs of rights that should not sit with one person, the roles that hold them, and which pairs to look at first. Use the free How to Check That a Control Reduces the Risk: Confirm Safeguards Worksheet to list the safeguard, its owner, who checks it, and the proof it leaves.
Then read these articles:
- What Reports Do I Need for a Segregation of Duties Review?
- How Do I Find Conflicting Duties in Employee Access?
About SOD Check
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. A potential conflict does not prove fraud or a control failure.
Top internal controls and SOX education for growing companies.