Segregation of Duties and Access Reviews in a Financial System

Reference article · 5 min read

An audit finding on segregation of duties usually arrives with the same wording: one person can initiate a transaction, approve it, and then alter the record of it. That combination is what makes an error hard to catch and a misappropriation hard to see. The finding is rarely about the individual. It is about a configuration in which one account can complete a whole transaction cycle with no independent point of review.

Small agencies receive this finding often, because the same few people handle payroll, purchasing, cash receipting, and bank reconciliation. The answer is not always more staff. It is knowing which combinations of access matter most, documenting the compensating controls you actually perform, and keeping evidence that someone reviews who holds what access.

What segregation of duties means inside the system

Common internal control frameworks, including COSO and the GAO Green Book that many governments use as a reference, describe functions that should not rest with one person: authorization, custody of assets, recording, and reconciliation or review. In an ERP or fund accounting system, those functions become roles, and roles are collections of permissions to specific screens, transaction types, and approval steps.

The control therefore lives in the configuration, not the job description. A clerk whose duties say "data entry only" but whose account carries an approval permission still has the conflict. Conflicts usually arise by accumulation, when someone covers a vacancy and keeps the temporary access afterward.

The role pairs auditors test

Reviewers test a predictable set of combinations. Build a conflict matrix from this list and compare it against actual role assignments.

• Vendor master maintenance with payment release. Changing a vendor record, including remit-to address and banking details, then releasing payment to it. Commonly treated as the highest risk pair in accounts payable.
• Journal entry creation with approval or posting. Especially where entries can reach cash, control accounts, or closed periods.
• Requisition, purchase order approval, and receiving. One person requesting, approving, and confirming receipt allows payment for goods never delivered.
• Payroll master data with payroll processing. Changing a pay rate or adding an employee, then running the pay cycle.
• Cash receipting with bank reconciliation or receivable adjustment. Taking in cash and being able to write off the receivable that would reveal a shortage.
• User administration with any transaction role. An administrator who can grant rights, transact, and remove the rights afterward. Often the most overlooked pair.

Add system-level conflicts. The ability to alter audit logs, change workflow thresholds, or open and close accounting periods should sit with a small, named group.

Compensating controls when you cannot separate everything

Auditors generally accept that a department of three cannot achieve textbook separation. What they look for is a documented alternative that is performed and evidenced.

• Independent review of change reports. A periodic report of vendor master additions and changes, reviewed outside accounts payable, with the reviewer's initials and date retained.
• Review from outside finance. A department head, manager, or elected treasurer can review bank reconciliations and payment registers without any ability to transact.
• Bank-side controls. Positive pay and dual authorization at the bank can substitute for separation you cannot achieve internally.
• Approval thresholds in workflow. Require a second approver above a set amount, kept low enough to be meaningful.
• Rotation of duties. Where staffing allows, rotating reconciliation work surfaces items a single preparer might otherwise carry forward.

Write each compensating control into policy, name the position that performs it, and keep the evidence. An undocumented control does not exist for audit purposes.

Running an access review that holds up

The periodic access review is the control that catches accumulation. Make it routine.

1. Export every active account with its assigned roles and last login date.
2. Route each department's list to the supervisor who can judge business need, not to IT.
3. Require an explicit decision per line: keep, remove, or change. A blanket approval is weak evidence.
4. Run the results through your conflict matrix and document any remaining conflict with its compensating control.
5. Track removals to completion and retain the tickets.

Review at least annually, and more often for high-risk modules. Tie access changes to HR events as well: separations, transfers, and the end of temporary coverage should each trigger a joint checklist among HR, the department, and IT.

Logging and evidence

Confirm what your system records and how long it keeps it: logins, permission changes, master data changes, and posted entries with the user ID. Verify that administrators cannot quietly edit those logs, and check log retention against your records schedule, since fieldwork comes long after the transactions. For daily use, exception reports beat raw logs: after-hours postings, duplicate vendor records, and first payments to new vendors.

Role design and what to ask a vendor

A new ERP implementation is the cheapest chance to get this right, and also the moment when broad administrator roles quietly spread. During procurement and design, ask:

• Do you provide a delivered conflict matrix, and can we modify it to match our positions?
• Can the system report conflicts across all roles assigned to a user, including conflicts created only by the combination?
• How is temporary delegation or emergency access granted, logged, and expired?
• What access review reports exist out of the box, and can supervisors certify inside the system?
• Which permissions cannot be separated from administrator roles, and what compensating control do you recommend?

In the contract, require role design deliverables that map a conflict matrix to your actual positions rather than a generic role catalog, and acceptance testing that includes negative tests showing restricted users cannot perform restricted actions. Audit expectations change, so confirm current ones with your external auditor or your state audit office.

HQT works with state and local government agencies on enterprise system design, including role and access control work in financial systems.

Frequently asked questions