Segregation of Duties When Your Finance Team Is Three People
Small finance teams cannot split every duty. Here is how to design compensating controls that auditors accept and that genuinely reduce risk.
Auditors love to recommend segregation of duties. Finance Directors with a team of three often wonder how they are supposed to achieve it without hiring two more people.
The honest answer is that full segregation is rarely possible in a small business, and auditors know this. What they look for is evidence that you understand where the conflicts sit and that you have compensating controls that would detect a problem.
Map the conflicts first
Start with the duties that matter most: setting up suppliers, approving invoices, releasing payments, posting journals, and reconciling bank accounts. List who can do each one, both in practice and in system permissions. The system view often surprises people, because access granted years ago rarely gets removed.
The highest risk combination is the same person being able to create a supplier, change bank details and release a payment. Break that chain first, even if everything else stays shared.
Use the bank and the system to help
Dual authorisation on the banking platform is the cheapest control available. Require a second approver, ideally outside the finance team, for payments above a set value and for any new payee.
Most accounting systems log changes to supplier master data. Run that report monthly and have someone independent review it.
Compensating controls that work
Where one person must hold conflicting duties, add a detective review. The Finance Director or a non executive reviews the bank reconciliation, a sample of journals and the supplier change report each month, and signs to show it was done.
Evidence is everything. A review that happens but is not recorded will not count with the auditor.
Revisit as you grow
Each new hire is a chance to redistribute duties. Keep a simple matrix of who does what, update it when people join or leave, and use it to remove access promptly. That matrix is often the first thing an incoming auditor asks to see.