Segregation of duties is an internal control that splits a transaction across different people so no single person controls it from start to finish. The auditing standards define it as assigning different people the responsibilities of authorizing transactions, recording transactions, and maintaining custody of assets, and it is intended to reduce the opportunities to allow any person to be in a position to both perpetrate and conceal errors or fraud in the normal course of that person’s duties (AICPA, AU-C 315, appendix C, paragraph 21). Separation of duties is the same control under a different name.
The Three Responsibilities Being Separated
Authorization is the decision that a transaction should happen at all. An authorization affirms that a transaction is valid, meaning it represents an actual economic event or is within the entity’s policy, and it typically takes the form of an approval by a higher level of management or of a verification and determination that the transaction is valid (AU-C 315, appendix C, paragraph 21). Recording is posting the transaction to the books. Custody is holding the asset the transaction moves, whether that is cash, inventory or the payment instrument itself.
The standard’s own illustration shows what the split is defending. A manager authorizing credit sales is not responsible for maintaining accounts receivable records or handling cash receipts, because someone able to perform all of those activities could create a fictitious sale that goes undetected (AU-C 315, appendix C, paragraph 21).
Some practitioner guides count reconciliation as a further function to separate, and the distinction is worth keeping straight. In the same standard, reconciliations are a separate type of control activity, comparing two or more data elements and generally addressing the completeness or accuracy of processing transactions, listed alongside segregation of duties rather than inside it (AU-C 315, appendix C, paragraph 21 and .A175). Keeping the reconciler away from custody and recording is still sound design, and a receipts cycle split that way is worked through in accounts receivable best practices.
Segregation of Duties in System Access
The abbreviation SoD is also used for the same split enforced by system permissions rather than by job titles. General IT controls include authorization controls that allow users to access the information necessary for their job responsibilities and nothing further, which facilitates appropriate segregation of duties, plus a separate control that segregates access to make and to migrate changes to a production environment (AU-C 315, appendix F, paragraph 2). The failure mode is named in the same standard, as IT personnel gaining access privileges beyond those necessary to perform their assigned duties and thereby breaking down segregation of duties (AU-C 315, appendix E, paragraph 18).
Where Headcount Runs Out
Segregation is sometimes not practical, cost effective or feasible, and smaller and less complex entities may lack sufficient resources to achieve ideal segregation (AU-C 315, appendix C, paragraph 21). In an owner-managed entity, the owner-manager may be able to exercise more effective oversight through direct involvement than in a larger entity, which may compensate for the generally more limited opportunities to segregate, though domination of management by a single individual can itself be a potential control deficiency because it creates an opportunity for management override of controls (AU-C 315, .A179).
When the headcount is not there, the standard’s answer is an alternative control rather than an exception: management may institute alternative controls, and its own example is a detective one, having personnel unrelated to the sales function periodically review whether and under what circumstances the salesperson changed prices (AU-C 315, appendix C, paragraph 21). What that looks like across a payables function is set out in an accounts payable job description, and on the requesting side in requisitions.
Absence can carry a reporting consequence in an audit. Absent or inadequate segregation of duties within a significant account or process is one of the circumstances the AICPA lists as a possible deficiency, significant deficiency or material weakness in the design of controls, and the auditor should communicate in writing to those charged with governance, on a timely basis, the significant deficiencies and material weaknesses identified during the audit (AICPA, AU-C 265, .11 and .A38).
Segregation of Duties Versus a Test of Controls
Segregation of duties is a control design, meaning a standing decision about who is allowed to do what. A test of controls is the audit procedure that evaluates whether that design actually operated over the period. A client can have the split written into every job description and still fail the test if one person covered for another through August.
Does GAAP Address Segregation of Duties?
Segregation of duties is an internal control concept rather than a measurement or presentation rule, so the question sits outside GAAP. In audit and attest work the wording a US firm works from sits in the auditing literature, with the definition at AU-C 315, appendix C, paragraph 21, and the consequence of its absence handled under AU-C 265 (AICPA, AU-C sections).
A firm working from an internal control framework instead takes the same split from that framework’s own wording, and the labels change. The federal internal control standards put the three functions as authority, custody, and accounting of operations, and say that management considers the need to separate control activities related to them to achieve adequate segregation of duties within the entity’s business processes (GAO, Standards for Internal Control in the Federal Government, paragraph 10.22). Those standards bind federal entities, so for a private firm they are a second naming of the same control rather than a rule it is held to.
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, and a firm can put a block of its own work through a trial task before any of it carries a signature.
