Segregation of duties in accounts payable means that the person who sets up a supplier, the person who approves an invoice and the person who releases the payment are not all the same person. It is the most cited control in payables and the one small businesses most often cannot implement, which produces a great deal of quiet embarrassment and not much useful thinking. The realistic position is that the ideal is often unachievable, that partial separation is worth considerably more than none, and that where separation is impossible a compensating control is a recognised and honest answer. This page is how to get as far as you can.
The three duties that should not combine
Setting up or amending a supplier, approving an invoice for payment, and releasing the payment. Any one person holding all three can create a supplier, approve an invoice to it and pay it. That is the specific scenario the control exists to prevent, and it is worth naming plainly.
Partial separation is worth a lot
If you can only separate one thing, separate supplier setup from payment release. That single split breaks the scenario above even when the same person does everything else, and it is usually achievable with an owner holding one of the two.
Compensating controls when separation is impossible
An owner or director reviews new suppliers, bank detail changes and the payment run before release, and the review is recorded. This is the standard answer for small businesses. It is weaker than separation because it is detective rather than preventive, and it is far better than nothing.
Questions people ask about segregation of duties accounts payable
Is our insurance affected by this?
Possibly, and it is worth asking. Some fidelity and crime policies ask about payables controls, and an honest answer with a compensating control is better than an optimistic one.
Does software provide segregation?
It provides the mechanism, through roles and permissions. It cannot provide the second person, which is the part small businesses lack.
How do we explain the gap to an auditor?
Directly, with the compensating control and its evidence. Auditors see this constantly in small companies; what they react badly to is a control described in a policy and not performed.