Segregation of Duties for Small Teams: 3 Controls for a One-Person Finance Team

Most guidance on segregation of duties assumes a finance department with a payables clerk, a treasury function and a controller. Small businesses and nonprofits do not have that. They have one bookkeeper, sometimes part-time, and an owner or executive director who is busy with everything else. This guide is written for that team. It explains the principle, shows what it looks like with one, two and three people, and sets out the three controls that do most of the work when you cannot add headcount.

What is segregation of duties in accounting?

The idea is simple: split every money-related process into steps, and give the steps that could be combined to cause harm to different people. The COSO internal control framework and the GAO Green Book both treat segregation of duties as a core control activity, and both recognize that when there are not enough people to separate duties, management should put alternative controls in place.

There are four functions to keep apart:

Function	What it covers	Example
Authorization	Approving that a transaction should happen	Approving a vendor invoice, a pay rise, a refund
Custody	Access to the asset itself	Releasing a payment in the bank portal, holding the company card, handling cash
Recording	Entering the transaction in the books	Posting the bill, coding the expense, creating the vendor
Reconciliation and review	Checking the books against an independent source	Reconciling the bank statement, reviewing the payroll register

The dangerous combinations are the ones that let a person both cause a problem and hide it. Someone who can create a vendor, enter a bill and release the payment can pay themselves. Someone who records cash receipts and also reconciles the bank account can cover a missing deposit. The aim is that at least one step in every chain is done, or reviewed, by someone else.

Can you give me an example of segregation of duties?

Here is how the same processes can be split in teams of one, two and three people. "Owner" means whoever is ultimately accountable: the business owner, CEO, executive director or board treasurer.

Process	One bookkeeper + owner	Two in finance + owner	Three in finance
Paying a vendor	Bookkeeper enters the bill and sets up the payment. Owner approves and releases it in the bank portal.	Person A enters bills. Person B sets up payments. Owner releases.	A enters, B approves within a limit, C or the owner releases.
New vendor or bank detail change	Bookkeeper requests. Owner verifies by phone and approves.	A requests. B verifies by phone. Owner approves large vendors.	Vendor master changes restricted to one person who does not pay bills.
Customer receipts	Customers pay electronically into the bank. Bookkeeper records from the bank feed. Owner reviews the reconciliation.	A records receipts. B reconciles the bank. Owner reviews.	A invoices, B records receipts, C reconciles.
Payroll	Owner approves hires and pay changes in writing. Bookkeeper runs payroll. Owner reviews the register before release.	A runs payroll. B checks the register against approved changes. Owner releases funding.	HR or manager approves changes, A runs, B reviews.
Bank reconciliation	Bookkeeper prepares. Owner reviews against statements received directly from the bank.	The person who did not record cash prepares it. Owner reviews.	C prepares, controller or owner reviews.

Notice that in the one-person column, the owner appears in almost every row. That is the point. Segregation of duties in a small team is less about splitting the finance job and more about the owner taking back the few steps that matter most, and doing them reliably.

How do you segregate duties with only one person in accounting?

You cannot split the work four ways, so you design around three controls. Together they cover the main ways money leaves a small organization without anyone noticing. Each takes the owner or a board member a small, predictable amount of time.

Control 1: The owner approves and releases payments

The bookkeeper can prepare payments, but cannot send them alone. In practice:

• Set up the online banking so the bookkeeper's login can create payments but not release them. Most business banking platforms support dual authorization; ask your bank to enable it.
• Set a threshold. Below it, the owner can approve a batch weekly. Above it, each payment needs individual approval with the invoice attached.
• Keep the owner's banking credentials and any security token with the owner. Sharing them removes the control entirely.
• For checks, the bookkeeper is not an authorized signer, and blank check stock is stored securely.

This control prevents the largest single risk: a payment made to the wrong account, whether by error, by a fraudster impersonating a vendor, or by an insider.

Control 2: An independent review of the bank reconciliation

The bookkeeper reconciles every bank and card account every month. Someone else reviews it, using statements they get directly from the bank, not copies the bookkeeper forwards. The review is short if you know what to look for:

• Does the reconciled balance match the bank statement balance on the last day of the month?
• Are there reconciling items older than one month? Old outstanding items are the most common place errors and misuse hide.
• Scan the payee list on the statement. Any names you do not recognize? Any payments to individuals?
• Are there transfers between accounts that you did not expect?
• Sign and date the reconciliation, or approve it in the accounting system, so there is evidence the review happened.

Give the reviewer read-only access to the bank portal so they can look at any time, not only at month-end. If you want to match two lists yourself, bank against ledger, the free two-list reconciler shows what is missing from each side. For the reasons a reconciliation will not tie, see why month-end reconciliation breaks.

Control 3: A monthly exceptions review

Most accounting systems can produce a few standard reports that, read together, show the changes a single person could make without anyone noticing. Run them every month and have the owner read them, ideally in the same sitting as the bank reconciliation review:

• New vendors added this month, and payments to vendors paid for the first time.
• Vendor bank detail changes. Every change, with the date and who made it.
• Manual journal entries above a threshold, with the reason for each.
• Credit notes, write-offs and voided transactions.
• Payroll changes: new employees, terminations and pay rate changes, compared to what was approved.
• Changes to closed periods, if your system logs them.

The review takes a short sitting in a typical month. Its value is not only in what it catches; it is that everyone knows it happens.

These three controls map onto a model Dr. Michelle Gordon describes in her guide for leaders: distinct preparer, verifier and strategic leader responsibilities, even when a small team has to share them. In a one-person team, the bookkeeper prepares and the owner or board does the verifying.

Who should approve vendor payments and verify bank detail changes?

The owner, the executive director, or a board officer such as the treasurer. Not the person who enters the bills. This question deserves its own rule because changed bank details are the route used in business email compromise, where a fraudster impersonates a vendor or an executive and asks for future payments to go to a new account. The FBI's Internet Crime Complaint Center (IC3) collects reports of these schemes.

A simple, strict procedure works best:

1. No bank detail change is accepted by email alone, however genuine the email looks.
2. The change is verified by calling the vendor on a phone number already in your records, never one in the request.
3. The person who verifies is not the person who will pay the vendor.
4. The verification is recorded: who called, which number, who confirmed, and when.
5. The first payment to new details is small or reviewed with extra care, and the vendor is asked to confirm receipt.

The same rule applies to internal requests. An urgent message that appears to come from the CEO asking for a same-day transfer gets the same call-back.

How does segregation of duties work in a small nonprofit?

A small nonprofit has an advantage a small business does not: a board. Board officers can take on the review steps that a business owner would do.

• The treasurer or finance committee chair reviews the monthly bank reconciliation and the exceptions reports, and receives bank statements directly.
• Two signers are required for payments above a threshold, and the executive director should not be the second signer on their own expense reimbursements.
• Two people count cash received at events or in the mail, and both sign the count sheet before it is deposited.
• Restricted grants are reviewed against the award terms by someone other than the person charging costs to them.
• The board minutes record that the reviews happened, which is also the evidence a funder or auditor will ask to see.

The general checklist in internal controls for small businesses and nonprofits covers the rest of the control set.

Common mistakes

• Rubber-stamp approvals. An owner who approves a batch of forty payments without looking at payees is not segregating anything. Keep batches small enough to read.
• Shared credentials. If the bookkeeper knows the owner's banking password, there is one person with full control, whatever the org chart says.
• Reviewing copies. A bank statement forwarded by the person being reviewed can be edited. Get it from the bank.
• Stopping during holidays. Controls lapse when the reviewer is away. Name a back-up reviewer.

How DataWyse helps

The third control, the exceptions review, is the one that slips first because it means pulling several reports and reading them side by side. DataWyse connects read-only to the accounting system and runs daily checks on payables, receivables and spend against the targets you set, so unusual payments and drift surface as they happen. Every figure is shown with its formula and the underlying records, so the owner or treasurer can trace an exception to the transaction without asking the bookkeeper to pull it.

It does not approve payments or replace the person doing the review. The controls above still depend on a named person who looks, signs and asks questions. DataWyse makes the looking faster.