Segregation of duties in AP: when one person does two jobs
In Brief
- Segregation of duties in accounts payable means no one person can start, approve and pay the same transaction.
- It bends in ordinary moments, such as a short-staffed team or an absent colleague, when a sensible decision on the day leaves a gap.
- The aim is a design that keeps segregation in place even when people cannot.
Picture a payment run at month end. One of the two people who release payments is away, so the AP manager steps in to cover, because the run has to go out. They approved most of these invoices earlier in the week, so they release them as well. Everyone makes a sensible decision, and the run goes out on time. But for that run, one person did two jobs, the gap that segregation of duties in accounts payable exists to close.
Segregation of duties in accounts payable is the practice of making sure no single person can start, approve and pay the same transaction. It is a design principle, not a judgement about trust. This post looks at how it bends under everyday pressure, why the gap is hard to see, and how to design so it holds when people cannot.
What segregation of duties in accounts payable means
Segregation of duties in accounts payable divides the work of paying a supplier, so that no one person can start, approve and pay the same transaction without a second set of eyes. One university finance office puts it the same way: no one person should initiate, approve, record or reconcile a transaction, and at least two sets of eyes should see every transaction.
SoftCo reads that as four jobs to keep apart:
- Setting up or changing a supplier record.
- Raising or entering an invoice.
- Approving the invoice.
- Releasing the payment.
Segregation of duties exists because any one person can make a mistake, and a second set of eyes is the simplest way to catch it. It says nothing about the person in the role.
The Supplier Control Framework treats it the same way. It places segregation of duties under governance control and applies it at every decision point, not simply through documented policy.
The framework opens with the audit question: if an auditor asked how a payment was approved, could you explain it, end to end? Part of that explanation is who released the payment, and whether that was the same person who entered it. Segregation of duties in accounts payable is what keeps that part of the answer simple.
How segregation of duties bends under pressure
The gap does not need a dramatic moment. It opens in ordinary ones. A team runs short-staffed in the last week of the quarter. A manager steps in to cover an absent colleague. The same person raises and approves a payment, because the other approver is in a meeting and the supplier is waiting. None of these is necessarily fraudulent, and each is a reasonable decision on the day.
The framework describes the pattern directly. In practice, it says, segregation of duties bends under exactly the conditions where it should hold firmest: volumes spike, someone is on leave, and the two roles collapse into one set of hands to keep the queue moving.
Segregation of duties is a design principle, not a mistrust principle.
The framework calls these collusion-shaped gaps. The name describes the shape of the gap, not the people in it. A collusion-shaped gap is not evidence of collusion. It is evidence that the control design does not account for the pressures people work under.
Why gaps in segregation are hard to see
In our reading, the gap is hard to see because every step looks like a normal approval. What is missing is a second person, and an absence is easy to overlook unless someone looks for it.
The framework gives a second reason. Because the change happens for practical reasons, with no ill intent, few people notice it. The separation still exists in the policy document. In the framework’s words, it has stopped existing in the work.
That is why reading the policy proves little. The better test is whether the separation holds on the busiest day of the month, not the quietest.
Automation does not settle the question either. The framework’s own warning is that automation moves the work but does not remove the need to govern it. A faster process makes more decisions in less time, so there are more decisions to account for. Our post on the duplicate payment that gets through looks at a related control, the duplicate check, and the supplier data it depends on.
How to design segregation that holds
The aim is a design where the separation does not depend on who is in the office. The framework states the principle in five words: segregate duties, especially under pressure. It adds that controls matter most when workloads increase, and that authority should never collapse when the business is busy.
Two stages of the framework show what that looks like. At matching and approval, authority is real and segregated: the person who processes is not the one who releases. At payment release, the release is separated from the approval and carries its own distinct control.
The same applies upstream. At the supplier record stage, the framework looks for a record built under segregation of duties, so that changing a supplier’s details is a separate job from paying against them. Supplier changes are a point where one pair of hands can quietly do two jobs, so it is worth asking who can do both.
Covering for a colleague is not the problem. The design question is what stays in place when someone does. Where roles cannot be separated, for example in a smaller team, one university finance office requires a detailed supervisory review as a compensating control.
What to ask about your own approvals
You can test this without accusing anyone. Ask five questions about how your approvals work on a normal day, and then on the busiest day of the month:
- When an approver is away, who covers, and can the cover also release payments?
- Can the person who enters or raises an invoice also approve it?
- Is payment release separated from approval, with its own control?
- Which checks change when volumes spike, and who decides?
- Could you show an auditor the separation in the work, not only in the policy document?
If an answer is “it depends who is in”, treat it as a finding about the design, not about the people. SoftCo’s AP control checklist covers controls across the payables process.
The system should be designed so that segregation holds even when people cannot. Use the framework to test segregation of duties in accounts payable in your own process, one stage at a time.
Check your own process against the framework.
Nine stages, one control question each.
Frequently askedquestions
Segregation of duties in accounts payable means no one person can start, approve and pay the same transaction without a second set of eyes. It is a design principle, not a judgement about trust.
In payables, that usually means setting up or changing supplier records, raising or entering invoices, approving them, and releasing payment. The aim is that each step has a second person behind it.
When one person covers two steps, the second set of eyes is missing for that transaction. It usually happens for practical reasons, such as an absence or a spike in volume, and it is easy to miss because the records look complete and the policy still says the roles are separate.
Where roles cannot be separated, use a compensating control, such as a detailed supervisory review of the related activities. Then test it on the busiest day of the month, not only on a quiet one.
A collusion-shaped gap is the Supplier Control Framework's term for a gap where one set of hands ends up doing roles that should be separate. It is not evidence of collusion. It shows that the control design does not account for the pressures people work under.