Segregation of duties when there are three of you

The classic control is simple: nobody should be able to both create a transaction and approve it, or both hold an asset and account for it. One person doing all four means errors go unnoticed and theft goes unnoticed for the same reason — nothing independent ever looks.

Then you look up and there are three of you.

The four functions#

Textbook segregation splits four things:

• Authorisation — deciding a transaction should happen.
• Custody — having access to the asset, usually the bank.
• Recording — entering it in the books.
• Reconciliation — checking the record against reality.

The dangerous combinations are custody with recording (you can take money and hide it), and authorisation with custody (you can approve your own payments).

What to separate first, with three people#

You will not achieve full separation. Order the compromises deliberately:

Never combine custody and reconciliation. If the person who can move money is also the only person who checks the bank reconciliation, nothing in the system will ever notice a problem. This is the one to break first, and it is also the cheapest — reconciliation review takes minutes and needs no expertise, only attention.

Keep payment authorisation away from the person who sets up payees. Adding a supplier and paying a supplier are the two halves of the most common small- business fraud. Splitting them is usually possible even in a tiny team.

Accept that recording will overlap with everything. The bookkeeper will touch every transaction. That is fine, provided somebody else looks at the output.

Substituting detection for prevention#

Where separation is impossible, these do real work:

An owner who reads the bank statement. Not the reconciliation — the statement, from the bank, directly. Ten minutes a month. It is the single most effective control available to a small company, and it costs nothing.

Dual authorisation above a threshold. Not every payment; a number that matters. Most fraud is not one large transfer.

An immutable ledger. If posted transactions cannot be edited or deleted, and corrections are visible reversals, then concealment requires additional entries rather than a quiet edit. It does not prevent anything, but it guarantees that whatever happened left a trail.

An audit log that distinguishes actors. Knowing which human — or which connected assistant — made a change turns "the books say" into "this person, on this date, changed this".

Access is a control, and it decays#

The control that erodes fastest is the one nobody revisits: who can see and do what. Staff change roles, contractors finish engagements, an accountant is given access for one year-end and keeps it for four.

A quarterly review of who has access to the books and the bank, and at what level, catches almost all of this. It takes fifteen minutes and it is the difference between a role-based system and a list of everyone who has ever worked here.

Role-based access only helps if the roles mean something. A team where everyone is an administrator has documented its lack of segregation rather than fixed it.

The honest position#

A three-person company cannot implement textbook internal control, and pretending otherwise produces policies nobody follows. What it can do is make sure that every material movement of money is visible to at least two people, and that the record of what happened cannot be quietly rewritten.

That is a defensible position to be in — and it is the one an auditor, a lender or an acquirer will actually ask about.