What is segregation of duties?
Segregation of duties is a simple rule: the person who starts a payment is not the person who approves it, and neither of them is the person who checks the bank statement. The aim is that one mistake or one dishonest act cannot pass through the whole process unseen.
Auditors and donors look for it because it is cheap, and it removes most of the easy routes to fraud and error. It does not assume anyone is dishonest. It protects honest staff, too, because it shows who did what.
Which tasks should be kept apart?
Think of four tasks in any money process:
- Authorize. Decide that the spend may happen.
- Record. Enter it in the books.
- Handle. Hold or release the money, or the cheque, or the payment file.
- Reconcile. Compare the books to the bank statement.
One person doing all four can hide a problem forever. One person doing any two can often still do harm, for example authorizing and handling, or recording and reconciling.
What can you do with only two or three people?
You will not always have four people. These workarounds are common and acceptable if you write them down:
| Problem | Workaround |
|---|---|
| One finance officer records and prepares payments | A manager approves each payment and reviews the payment list before release |
| The same person reconciles and records | A second person, such as the director or a board treasurer, reviews the reconciliation each month and signs it |
| The only approver is the budget holder | A second approver from another team signs above a set amount |
| One person holds petty cash and approves top-ups | The manager counts the cash at random times and signs the count |
| No one to review at all | An outside accountant or a volunteer reviewer checks a sample of entries each quarter |
These are called compensating checks. They do not remove the risk, but they make it visible.
Who else can take a task?
Look beyond the finance office. Useful second people include:
- A program manager, who confirms that the work was done before payment.
- A country director or executive director, who approves above a limit.
- A board treasurer, who reviews bank reconciliations and unusual items.
- An outside accountant, who checks a sample on a schedule.
Keep roles clear. The program manager confirming delivery should not also be the person who raised the request. Our guide to payment request approvals shows how to set that up.
What rules help most?
Four rules cover most of the risk:
- The requester never approves their own request.
- One person never approves two steps of the same payment.
- The person who reconciles the bank does not record the transactions or release payments.
- Changes to payee bank details are confirmed by a second person, by a call to a known number.
Add a rule for leave. When the approver is away, a named delegate acts for a set period. The delegate is never the requester.
How do you handle an exception?
Sometimes you truly cannot split a task, for example during a staff gap. Treat it as a short, recorded exception:
- Write what task is combined and why.
- Name a second person who will review the result.
- Set an end date.
- Record who agreed.
A written exception is a control. A silent one is a finding waiting to happen. Review exceptions at your monthly finance meeting, and close them when the gap ends.
What should you record?
For each approval, keep the approver’s name, role, date and decision, plus a note when something is unusual. For each reconciliation, keep the preparer, the reviewer and the sign-off date. An auditor will ask for these. If you can produce them in minutes, you have shown the control works.
Where EMPOBase fits
EMPOBase applies some of these rules for you inside the workspace. In Payment Requests and Procurement, the requester cannot approve their own request and one person cannot approve two steps of the same request. Each decision records who acted, when and any note. Roles and permissions control who can approve and who can see what. EMPOBase does not make bank transfers, so the person who releases the payment and the person who checks the bank statement remain a matter for your own process. See the platform overview or ask for a walk-through.