Segregation of Duties in Accounts Payable

When an AP fraud case is finally uncovered, the post-mortem is almost always the same: one person could do the whole thing. They could set up a vendor, approve its invoices, and release its payments — three steps that should never sit with one set of hands. That concentration is the vulnerability. Segregation of duties is the control that closes it.

Segregation of duties (SoD) is the deliberate splitting of an AP process so that no single person can both create and approve the same transaction. It does not assume anyone is dishonest. It assumes that if completing a fraud requires collusion between two people, most fraud simply will not happen — and honest mistakes get a second set of eyes for free. This guide covers the conflicts that matter, how small teams can still apply it, and how to enforce it without paralyzing AP.

The Conflicts That Matter Most

Not every separation is equally important. A handful of role combinations account for the large majority of AP fraud risk, and those are the ones to separate first.

Segregation of Duties on a Small Team

The standard objection is real: 'We have three people in accounting — we cannot separate five duties.' True. But small teams are not exempt from the risk; they are exposed to more of it, because concentration is unavoidable. The answer for small teams is not full separation — it is compensating controls.

If the same person must set up vendors and approve invoices, then a second person — an owner, a controller, a CFO — reviews a report of all new vendors and all bank-detail changes every month. The duties are not separated, but the second look reintroduces the missing eyes. The control is preserved even when the headcount is not there to split it cleanly.

Why Manual SoD Erodes

Even when a company designs segregation of duties correctly, it erodes in practice. An approver is on vacation, so someone steps in 'just this once.' A clerk gets temporary access to clear a backlog and it is never revoked. The org chart says the duties are separate; the day-to-day reality drifts. Manual SoD depends on everyone remembering the rules under deadline pressure — and that is exactly when it fails.

“Our segregation of duties was perfect on paper. Then year-end pressure hit, the controller was out, and for three weeks one person was setting up vendors and releasing payments. Nothing went wrong — that time. We realized the policy meant nothing if the system did not enforce it.”

— CFO, regional construction firm

Enforcing SoD Without Slowing AP Down

The fear with segregation of duties is that it adds friction — more handoffs, more waiting. Designed well, it does not. The key is that enforcement should be automatic and invisible until it is needed: the system simply will not let the person who created a vendor approve its first payment, and routes it to someone else. There is no policy to remember, and no extra step for the 99% of transactions where one person was never going to do all the jobs anyway.

Segregation of Duties as a Built-In Rule

Covinly enforces segregation of duties as a built-in rule of the workflow rather than a policy people have to honor. A user who created a vendor or uploaded an invoice cannot also approve it; bank-detail changes route the next payment to a different approver; conflicts are blocked automatically, with the reason recorded in the audit trail. The control holds during year-end crunch and vacations — the moments when manual SoD always slipped before.

Separate the conflicts that matter most, use compensating reviews where the team is too small to split duties, and make enforcement automatic so the control survives pressure. Segregation of duties is not about distrust — it is about making sure no single mistake, or single bad actor, can run all the way to a payment.