Designing control procedures (Internal Controls): Segregation of duties (SoD) and authorization powers
Designing Internal Controls: Segregation of Duties (SoD) and Authorization Levels
Internal Control Procedures: A professional guide on how to design Internal Controls via Segregation of Duties (SoD), defining authorization levels, and linking them to document cycles to reduce fraud and error risks—Digital Salla.
- What is Segregation of Duties (SoD) and which roles must never overlap?
- How to design an Authorization Matrix (Limits of Authority).
- Linking controls to the Document Cycle (Purchase Order, Receipt, Invoice).
- Practical examples: SoD in Cash, Inventory, and Payroll management.
- Identifying “Conflict of Interest” points in digital accounting systems.
1) The Concept of Segregation of Duties (SoD)
Segregation of Duties (SoD) is an internal control principle designed to prevent error and fraud by ensuring that no single individual is in a position to both perpetrate and conceal errors or fraud in the normal course of their duties.
2) The Three Phases of a Transaction (The ARC Rule)
To achieve effective segregation, the following three responsibilities must be held by different people:
- Authorization (A): Approving the transaction (e.g., Department Head).
- Recording (R): Entry into the ledger (e.g., Accountant).
- Custody (C): Handling the physical asset (e.g., Cashier or Storekeeper).
3) The Security Triangle (Visual Logic)
Why breaking the triangle leads to “Total Control” by one person?
5) Controls in the Document Cycle (Three-Way Match)
In the Purchase-to-Pay cycle, the primary control is the Three-Way Match. You only pay an invoice if it matches two other documents:
Purchasing Controls Template - Excel Template
- Purchase Order (PO): What we Ordered.
- Receiving Report (GRN): What we Received.
- Vendor Invoice: What we are Billed.
6) SoD Examples by Department
6.1 Cash Management
The person who receives customer checks (Custody) must not be the same person who updates the Accounts Receivable ledger (Recording).
6.2 Inventory Control
The storekeeper (Custody) should never perform the Physical Year-end Count (Independent Verification). The count must be done by the finance team or internal audit.
6.3 Payroll
The HR manager who adds a “New Employee” to the system must not be the same person who “Approves the Bank Transfer” for monthly wages.
7) Digital Controls in Accounting Systems
In modern ERP systems, segregation is handled via User Roles and Permissions:
- Sequential Numbering: Ensuring no missing invoices or duplicate entries.
- Audit Trail: A log that records every change, who made it, and when.
- Forced Approval Workflows: The system physically prevents an accountant from clicking “Pay” until a manager has clicked “Approve.”
8) Operational Controls & Readiness Checklist
To evaluate your Control Procedures today:
SoD Quality Gate Checklist
- Are user passwords in the accounting system changed every 90 days?
- Is there a formal list of “Who can sign checks/authorize transfers”?
- Do we perform surprise Petty Cash counts?
- Are “New Vendors” verified for existence (Tax ID check) before payment?
- Is the Master Budget used to block over-spending automatically?
9) Common Errors and How to Prevent Them
- Sharing Passwords: Managers giving their credentials to accountants to “Speed up” work. This destroys the audit trail.
- The Trusted Employee Trap: Bypassing controls because an employee has been with the company for 20 years. Controls are for systems, not for people.
- Rubber Stamping: Approving transactions without actually looking at the supporting documents (PO/GRN).
- Ignoring IT Superusers: Allowing the IT head to have “Write” access to the accounting database without oversight.
10) Frequently Asked Questions
What is Segregation of Duties (SoD)?
It is the practice of dividing critical transaction tasks among multiple employees to reduce the risk of errors and fraud.
How can a small company implement SoD with only 2 staff members?
By involving the Owner/Manager in the approval and bank reconciliation phases. If you can’t separate duties, you must increase Direct Supervision.
What is a Compensating Control?
It is an alternative procedure (like a higher-level review) used when a primary control (like SoD) cannot be implemented due to cost or staffing limits.
11) Conclusion
Designing Control Procedures is the art of building a “Self-Correcting System.” By strictly enforcing Segregation of Duties, utilizing a clear Authorization Matrix, and anchoring your transactions in the Document Cycle, you protect the entity’s wealth and the integrity of its data. These procedures don’t just prevent theft; they build Operational Excellence that attracts investors and ensures the long-term sustainability of your organization.
Action Step Now (30 minutes)
- Open your payment software (Bank portal or ERP).
- Check: Is it possible for One User to create a vendor AND pay them?
- If yes, call your IT department immediately to implement Dual Authorization.