How to Test Segregation of Duties Effectively

A vendor payment that is properly recorded can still represent a serious control failure if one employee created the vendor, approved the invoice, released the payment, and reconciled the bank account. For a CFO or board treasurer, the question of how to test segregation duties usually arises when the organization needs more than a written policy. It needs evidence that incompatible responsibilities are separated in day-to-day practice.

Testing segregation of duties is not an exercise in proving that every task belongs to a different person. Smaller nonprofits, public entities, housing organizations, and closely held businesses often cannot staff every finance function separately. The objective is to identify where one person could initiate and conceal an error, misuse of assets, or noncompliant transaction, then determine whether effective controls prevent or detect that risk promptly.

Start With the Risk, Not the Job Titles

A current organizational chart is useful, but it is not enough. Titles rarely show who actually enters a journal entry, has online banking access, receives grant reimbursement support, or can override an approval in the accounting system. Begin by mapping the transaction cycle from start to finish for the areas with the greatest financial or compliance exposure.

For most organizations, that means examining cash receipts, disbursements, payroll, purchasing, revenue or grant billing, journal entries, and financial reporting. In a school district or municipality, payroll and procurement may warrant particular attention. For a HUD-funded entity or affordable-housing developer, tenant receipts, restricted cash, draw requests, and reserve activity can create additional points of risk. Under Uniform Guidance, the review should also consider how expenditures are approved, coded, supported, and reported for federal awards.

The central question is simple: can one individual authorize a transaction, maintain custody of the related asset, record it in the books, and reconcile or review the result? The four functions are distinct:

• Authorization, such as approving a purchase order, invoice, payroll change, or journal entry.
• Custody, such as holding cash, checks, blank check stock, inventory, or bank access credentials.
• Recording, including vendor setup, invoice entry, posting receipts, and preparing journal entries.
• Reconciliation and review, including bank reconciliations, budget-to-actual review, and investigation of unusual activity.

Not every combination creates the same exposure. A program director may appropriately approve invoices but should not also have unrestricted authority to add vendors and release electronic payments. A controller may prepare a bank reconciliation, but an independent person should review it, including reconciling items and evidence of follow-up.

How to Test Segregation of Duties in Practice

A sound test has two parts: assessing control design and assessing operating effectiveness. Design testing asks whether the assigned responsibilities, system permissions, and review procedures would prevent or detect a material issue. Operating-effectiveness testing asks whether the controls actually functioned during the period under review.

Perform a documented walkthrough

Select one or more representative transactions and follow each from initiation through recording, payment or receipt, reconciliation, and management review. Speak with the employees who perform the work rather than relying only on procedures manuals. Ask them to demonstrate the process in the accounting system and provide the supporting documentation they use.

For an accounts-payable walkthrough, trace a purchase from request through approval, vendor setup, invoice entry, payment release, posting to the general ledger, and bank reconciliation. Identify each person involved, the system access they used, and the evidence that shows review occurred. A workflow that appears separated on paper may break down when one employee covers absences or when approval occurs through an informal email with no retained audit trail.

Review system access against actual responsibilities

Obtain user-access listings from the general ledger, accounts-payable platform, payroll system, online banking portal, donor database, and any purchasing or grant-management applications that affect financial reporting. Do not limit the review to active finance staff. Former employees, temporary staff, outsourced bookkeepers, and senior executives with emergency access can present meaningful risk.

Compare permissions to the duties each user performs. Look closely for access combinations that allow a person to create or alter master-file information and process a related transaction. Examples include the ability to add vendors and approve payments, create employees and modify payroll rates, post journal entries and approve them, or issue customer credits and process cash receipts.

System access alone does not establish a control failure. Some organizations deliberately grant broad access to meet operational needs. In those cases, test the compensating controls with equal rigor. A CFO's review of a weekly payment register may be a meaningful control only if the reviewer is independent, receives enough detail to identify anomalies, documents the review, and investigates exceptions.

Test a sample of transactions and reviews

Select transactions across the period, with attention to higher-risk items such as new vendors, manual checks, wire transfers, payroll adjustments, credit memos, unusual journal entries, and transactions near period-end. Inspect the evidence supporting each stage of the process. This may include purchase approvals, invoices, receiving documentation, payment logs, bank records, electronic approval histories, and reconciliation sign-offs.

The test should confirm more than the presence of initials or an electronic timestamp. Determine whether the reviewer had the authority and information needed to perform a meaningful review. For example, a board treasurer's signature on a check list is less persuasive when the list excludes vendor changes, voided checks, or wire activity. A monthly bank reconciliation review is weakened if it occurs months late or if old reconciling items are never resolved.

When sampling, consider volume, dollar value, susceptibility to fraud, changes in personnel or systems, prior findings, and the requirements of the engagement. A high-volume payroll process may require a larger sample or data analysis. A low-volume but high-risk wire process may justify testing every transaction.

Evaluate Compensating Controls Realistically

In a small finance department, complete segregation may be impractical. That does not eliminate the need for control. It shifts the focus to independent oversight that is specific, timely, and documented.

A compensating control might include an executive director reviewing bank activity directly from the bank portal, a board treasurer reviewing disbursements and canceled checks each month, or an outside accountant preparing reconciliations while management independently reviews them. For grant-funded organizations, periodic comparison of expenditures to approved budgets, award restrictions, and supporting documentation can also help detect improper activity before reporting deadlines.

The quality of the review matters more than its label. A control is not effective simply because it is called a management review. The reviewer must understand what is being reviewed, identify thresholds or exceptions requiring follow-up, and retain evidence of that follow-up. Boards should be particularly cautious about relying on informal verbal oversight where a written record is feasible.

Document Exceptions and Correct the Right Problem

When a test identifies incompatible duties, document the condition precisely. State who performs each function, which transactions or systems are affected, the risk created, whether a compensating control exists, and whether that control operated effectively. This level of clarity gives management and the audit committee a practical basis for remediation.

Corrective action may involve changing user permissions, requiring dual approval for payments, moving bank-reconciliation review to an independent employee, establishing vendor-change reports, or setting a formal cadence for board oversight. Training may be necessary, but training alone rarely resolves an access or workflow conflict. The remedy should address the source of the exposure.

Retest after changes are implemented. A revised policy does not demonstrate improvement until access has been changed, responsibilities have been reassigned, and the organization has retained evidence that the new review process is working. This is especially relevant before a Single Audit, Yellow Book audit, lender review, or regulatory monitoring visit, where control design and execution may both be examined.

A well-tested segregation-of-duties framework gives leadership something more useful than a clean checklist: the clearest picture your board will ever get of where financial authority sits, how it is supervised, and where prompt action will protect the organization’s resources and mission.