Knowledge base · Governance & controls
What is segregation of duties?
Short answer
Segregation of duties (SoD) is an internal control principle that divides the key steps of a transaction, namely authorising it, recording it, holding custody of the related asset and reconciling it, among different people, so that no single individual can both commit and conceal an error or fraud without another person's involvement.
Definition of Segregation of Duties (also: separation of duties, SoD, division of duties, four-eyes principle, maker-checker)
Segregation of duties (SoD) is one of the oldest and most effective internal controls. Its logic is simple: if the person who approves a payment is not the person who records it, and neither of them holds the cheque book or reconciles the bank account, then a fraud needs more than one person to succeed and is more likely to be noticed.
It is also known as separation of duties, the four-eyes principle or, in Indian banking and ERP language, maker-checker.
How does segregation of duties work?
Most transactions involve four functions that should ideally sit with different people:
| Function | Example in purchasing |
|---|---|
| Authorisation | Approving a purchase order or vendor payment |
| Recording | Entering the invoice and posting it in the ledger |
| Custody | Releasing the payment or holding goods received |
| Reconciliation and review | Reconciling the bank account or vendor ledger |
When one person performs two or more of these, they can both create and hide an improper transaction. Typical high-risk combinations are creating vendors and approving payments, maintaining payroll master data and processing payroll, and receiving cash and recording receivables.
Why does it matter for fraud prevention?
Many common frauds depend on a missing separation. A fictitious vendor scheme, one of the classic forms of vendor fraud, usually needs someone who can add a vendor and also push its invoices through. Teeming and lading, payroll ghosts and cash skimming, all forms of asset misappropriation, similarly exploit a single point of control.
The ACFE's Occupational Fraud 2026 report found that lack of internal controls (33%) and override of existing controls (19%) were the primary weaknesses in more than half of the cases studied. Weak segregation is frequently at the heart of both.
Where does SoD fit in the Indian regulatory framework?
The Companies Act 2013 does not list specific SoD rules, but it sets the obligation within which SoD operates. Under s. 134(5)(e), directors of listed companies confirm that internal financial controls are adequate and operating effectively, and under s. 143(3)(i) the statutory auditor reports on internal financial controls with reference to financial statements. Segregation of duties is one of the controls auditors and directors expect to see.
The COSO 2013 framework, widely used as the benchmark for internal control, treats segregation of duties as a consideration under its control activities component.
Red flags of weak segregation of duties
- One employee who "does everything" in accounts and never takes leave.
- Users with both vendor-master and payment-approval rights in the ERP.
- Shared login IDs or passwords, so it is impossible to tell who did what.
- Approvals given by the same person who initiated the entry.
- Bank reconciliations prepared and reviewed by the same person, or not reviewed at all.
- Senior managers able to post manual journals without review.
How is a breakdown of segregation of duties investigated?
When fraud is suspected, investigators map who actually performed each step of the relevant transactions, using ERP audit trails, user-access logs and approval records, not just the documented policy. Data analytics can quickly flag invoices created and approved by the same user, or vendors whose bank details were changed by the person who later approved their payments. This reconstruction often shows how long a weakness was exploited and by whom, which matters for recovery and disciplinary action. Former employees and those who held "temporary" access are a common blind spot and an insider threat risk.
How does SoD differ from related controls?
Segregation of duties is a specific control activity. A fraud risk assessment identifies where SoD matters most. Job rotation and mandatory leave are complementary controls that expose schemes needing constant attention. Access controls are the technical means of enforcing SoD in systems.
For more on control design, see internal controls. Our forensic accounting and data analysis service covers transaction testing and SoD conflict analysis when fraud is suspected.
Frequently asked questions
How can small companies achieve segregation of duties with few staff?
Full separation is often impossible in a small finance team, so compensating controls are used. Examples include the owner or a director approving all payments and vendor changes, bank statements going directly to someone outside accounts, mandatory leave with cover, system-enforced maker-checker for payments, and periodic independent review by an external accountant. The aim is that no one person controls a transaction from start to finish unseen.
What is an SoD conflict in an ERP system?
An SoD conflict exists when one user's system roles allow incompatible actions, such as creating a vendor and approving payments to it, or posting and approving journal entries. Conflicts often build up as staff change roles and keep old access. A periodic access review, comparing user roles against a conflict matrix, identifies them so access can be removed or a compensating control applied.
Does segregation of duties prevent collusion?
Not fully. Segregation of duties makes fraud harder because it requires two or more people to cooperate, but colluding employees, or an employee working with a vendor, can still defeat it. Rotation of duties, independent reconciliations, data analytics on approvals and a confidential whistleblowing channel help detect collusion that segregation alone cannot stop.