Segregation of Duties

Segregation of duties splits AP tasks across people so no one can create and hide an overpayment or contract violation alone. Written for finance and AP teams.

Twitter LinkedIn WhatsApp
Ask AI: ChatGPT Claude Gemini Grok
Segregation of Duties

Segregation of duties is an internal control that assigns the steps of a transaction, requesting, approving and paying, to different people so no single employee can both create an error and conceal it. In accounts payable, this means the person who sets up a vendor is not the person who approves an invoice, and neither is the person who releases payment.

The control does not catch margin drift. Margin drift is the gap between what a vendor contract says and what the invoice actually charges, and segregation of duties says nothing about whether a rate card or a not-to-exceed cap was honored. It only reduces the chance that one person quietly manipulates the payment path.

1. What does segregation of duties actually separate?

Segregation of duties separates three AP functions: vendor setup and maintenance, invoice approval, and payment release. Each function sits with a different person or role so that changing a bank account, approving a charge, and releasing the funds all require more than one set of hands. The goal is to make a single-actor fraud or cover-up require collusion instead of one login.

Smaller finance teams often compress these roles under time pressure, which is a staffing decision, not a contract control.

2. Why is this control not enough to catch overbilling?

Segregation of duties governs who can act, not whether the amount they approve is correct against the contract. An approver with no rate card, volume tier, or not-to-exceed cap in front of them can properly follow the control and still approve an overcharge. The control prevents internal manipulation; it does not verify external vendor accuracy.

See margin drift vs. legitimate price increases for how a correctly-approved invoice can still be wrong.

3. How does this differ from three-way matching?

Three-way matching checks that an invoice agrees with a purchase order and a receipt. Segregation of duties checks that no single person performed every step needed to push a payment out the door. One is a document control, the other is a staffing control, and a business can have either without the other.

A vendor overcharge that matches the PO passes three-way matching and passes segregation of duties, because neither control tests the contract terms behind the PO.

4. Where does an outside audit still find leakage despite this control?

An outside audit finds leakage where duties are properly split but no one on either side of the split is checking the invoice against the contract itself. Approval authority confirms a policy limit was respected; it does not confirm a rebate clause, escalation index, or minimum commitment was applied correctly.

This is the gap a contract compliance review closes: it tests the rate card and volume tier logic that segregation of duties was never designed to test.

For the wider pattern this sits inside, start with the margin drift guide.

5. Frequently Asked Questions (People Also Ask)

What is segregation of duties in accounts payable?

It is splitting invoice requesting, approving and payment release across different people so no one person controls a payment end to end. It reduces the risk of internal fraud or unnoticed error, not vendor overbilling.

Does segregation of duties prevent vendor overcharges?

No. It controls who can act on a transaction internally. A vendor can charge above the contracted rate card and still pass every internal approval step if no one checks the invoice against the contract terms.

Who typically holds each role in a segregated AP process?

Common practice separates vendor master maintenance, invoice coding and approval, and payment release into three distinct roles or people, often procurement, AP, and treasury or controller sign-off.

Is segregation of duties required by law?

Sarbanes-Oxley and similar internal control frameworks expect it for public companies and their auditors. This is general information, not legal advice; consult counsel on your specific compliance obligations.

Can a small AP team still segregate duties?

Yes, through compensating controls such as a second reviewer on high-dollar invoices or periodic sampling by someone outside the payment chain, when true separation is not staffing-feasible.

How does this relate to a contract compliance audit?

A contract compliance audit tests the substance of the invoice, the rate card, volume tier, and cap, while segregation of duties tests who was allowed to touch the payment. They address different risks and neither substitutes for the other.

Does ERP approval workflow count as segregation of duties?

Configured approval routing enforces the control mechanically, but it only works if the underlying roles are genuinely assigned to different people. A workflow with one person holding two roles does not achieve separation.

What is the difference between segregation of duties and internal controls generally?

Segregation of duties is one specific internal control among many. Internal controls also include reconciliations, authorization limits, and audit trails, each addressing a different point of failure in the payment process.

1. What does segregation of duties actually separate?

Segregation of duties separates three AP functions: vendor setup and maintenance, invoice approval, and payment release. Each function sits with a different person or role so that changing a bank account, approving a charge, and releasing the funds all require more than one set of hands. The goal is to make a single-actor fraud or cover-up require collusion instead of one login. Smaller finance teams often compress these roles under time pressure, which is a staffing decision, not a contract control.

2. Why is this control not enough to catch overbilling?

Segregation of duties governs who can act, not whether the amount they approve is correct against the contract. An approver with no rate card, volume tier, or not-to-exceed cap in front of them can properly follow the control and still approve an overcharge. The control prevents internal manipulation; it does not verify external vendor accuracy. See [margin drift vs. legitimate price increases](/guides/margin-drift-vs-legitimate-price-increases-how-to-tell-them) for how a correctly-approved invoice can still be wrong.

3. How does this differ from three-way matching?

Three-way matching checks that an invoice agrees with a purchase order and a receipt. Segregation of duties checks that no single person performed every step needed to push a payment out the door. One is a document control, the other is a staffing control, and a business can have either without the other. A vendor overcharge that matches the PO passes three-way matching and passes segregation of duties, because neither control tests the contract terms behind the PO.

4. Where does an outside audit still find leakage despite this control?

An outside audit finds leakage where duties are properly split but no one on either side of the split is checking the invoice against the contract itself. Approval authority confirms a policy limit was respected; it does not confirm a rebate clause, escalation index, or minimum commitment was applied correctly. This is the gap a contract compliance review closes: it tests the rate card and [volume tier](/glossary/volume-tier) logic that segregation of duties was never designed to test. For the wider pattern this sits inside, start with the [margin drift](/insights/margin-drift-spend-leakage-guide) guide.

Questions & Answers

What is segregation of duties in accounts payable?

It is splitting invoice requesting, approving and payment release across different people so no one person controls a payment end to end. It reduces the risk of internal fraud or unnoticed error, not vendor overbilling.

Does segregation of duties prevent vendor overcharges?

No. It controls who can act on a transaction internally. A vendor can charge above the contracted rate card and still pass every internal approval step if no one checks the invoice against the contract terms.

Who typically holds each role in a segregated AP process?

Common practice separates vendor master maintenance, invoice coding and approval, and payment release into three distinct roles or people, often procurement, AP, and treasury or controller sign-off.

Is segregation of duties required by law?

Sarbanes-Oxley and similar internal control frameworks expect it for public companies and their auditors. This is general information, not legal advice; consult counsel on your specific compliance obligations.

Can a small AP team still segregate duties?

Yes, through compensating controls such as a second reviewer on high-dollar invoices or periodic sampling by someone outside the payment chain, when true separation is not staffing-feasible.

Margin Drift Resources