Segregation of Duties With a Three-Person Finance Team

"We're too small for segregation of duties." It's the most common objection to controls in a business with one bookkeeper, one office manager, and an owner who signs things. It's half right. You can't build the four-way split an auditor draws for a 200-person company. You can make sure no single person can create a payee, release a payment to it, and record or reconcile it. That one rule covers most of what segregation of duties is for.

This article gives you the three-person version: which duties to separate first, a role matrix you can copy, and the compensating controls that fill the gaps you can't staff.

The four duties, and the one split that matters most

Segregation of duties separates four kinds of work so that one person's mistake or theft gets caught by another person's job:

1. Authorization: approving a transaction (a new vendor, an invoice, a raise).
2. Custody: access to the asset (releasing ACH, signing checks, handling deposits).
3. Recording: entering the transaction in the books.
4. Reconciliation: comparing the books to an outside record (bank, payroll provider, customer statements).

In a big finance department, four different people hold those. With three, someone will hold two. The question is which two.

The Bennett rule for a small team: custody and recording must never sit with the same person without an independent reconciliation by someone else. If your bookkeeper enters bills and releases ACH payments, the owner or a third person has to see the bank activity before the bookkeeper does. That's the minimum.

Why this split first? Because the two schemes that do the most damage in a small office, paying a fake or altered vendor and changing a payment after it's approved, both need the same combination: the ability to move money and the ability to make the record look normal afterward. Take either half away and the scheme needs a second person. The ACFE's Occupational Fraud 2026 report, built from 2,402 investigated cases, associates anti-fraud controls such as management review and proactive data monitoring with lower losses and faster detection. An owner who reads the bank activity independently is the cheapest management review a three-person firm can buy.

A three-person role matrix you can copy

Here's a workable split for a hypothetical $3M-$8M service firm with an owner, a bookkeeper, and an office manager who handles billing and collections. "A" means approves, "D" means does, "R" means reviews after the fact.

Look at what the matrix does. The bookkeeper can enter a bill but can't approve or release it alone. The office manager can bill clients and issue small credits but can't receive cash and record it. The owner releases payments with bank-side dual approval and reads the statement before anyone else.

The bookkeeper still reconciles the bank, which is technically a conflict with recording. That's acceptable only because the owner reads the statement independently every month. That's what a compensating control is.

Where three people can't split it: compensating controls

When you can't separate a duty, you add a control that would catch the problem afterward. The four that do the most work in small teams:

Bank-side dual approval

Most business banking platforms let you require a second user to approve outgoing ACH and wires above a threshold. Set it. Then a compromised bookkeeper login can't move money alone, and neither can the bookkeeper.

Owner-first bank statement review

Statements go to the owner directly, or the owner logs into the bank portal monthly before the reconciliation is done. Ten minutes. The point is to see the outside record before anyone has had a chance to explain it.

Vendor change log review

Accounting software usually keeps an audit trail of who changed what. Pull every vendor created or changed in the month. A vendor whose bank details changed with no matching phone verification is the single most important item to question. Our companion article on embezzlement signs walks through the full six-check monthly routine.

Mandatory time away

Someone else should run payables for at least one consecutive week a year. Schemes that need daily maintenance tend to break when the person maintaining them is gone. The ACFE's 2026 report lists refusal to take vacations among the behavioral red flags it tracks, with a median loss of $250,000 in cases where it appeared. Requiring the week off turns that red flag into a test, and it costs nothing but a cross-trained backup.

Not sure your current setup would catch a fake vendor or an off-cycle payroll run? Tell us who can create payees, release payments, and reconcile the bank, and a Leak Check on payment controls will point to where money leaves your business with only one set of eyes on it.

Software permissions do half the work

Most small-business control failures aren't people breaking rules. They're everyone being an admin. Before you redesign roles, open the user list in your accounting system, bank portal, and payroll provider:

• Accounting: the bookkeeper doesn't need the ability to delete or void transactions in closed periods. Lock periods after month-end close.
• Bank: separate "initiate" from "approve." Remove former employees the day they leave.
• Payroll provider: the person who adds employees shouldn't also approve the run.
• Card program: cardholders shouldn't be the ones who approve their own statements.

This is usually an afternoon of work, and it often fixes more than any new procedure.

Collusion is the limit of any split

Segregation of duties assumes the people you separate don't work together. When they do, the control fails, and it fails quietly, because each person's part of the record looks right to the other. A bookkeeper and an office manager who agree to share a fake vendor have defeated every row of the matrix above.

You can't design that risk away with three people. What you can do is keep one control outside the team entirely: the owner's direct bank review, an outside accountant's quarterly look at vendor and payroll changes, or an anonymous way for staff to report concerns. A reporting channel doesn't have to be a hotline service. In the ACFE's 2026 data, the most common ways tips arrived were web-based forms (46%), email (34%), and phone (23%). For a small firm, a simple web form or an email address that reaches the outside accountant, not the bookkeeper, covers the first two.

A four-week rollout

Don't announce a new control framework. Change one thing a week:

• Week 1: Pull the user lists from accounting, bank, payroll, and cards. Remove anyone who's left and anyone with admin rights they don't need.
• Week 2: Turn on dual approval at the bank for outgoing ACH and wires above your threshold. Move statement delivery to the owner.
• Week 3: Write the matrix with real names and share it with the team. Explain it as backup coverage, which it is, not as suspicion.
• Week 4: Run the first vendor change log review and the first payroll-to-roster tie-out. Note how long each took.

By the end of the month, each person knows which steps they own, and the owner has a 30-minute monthly review on the calendar.

When the matrix needs to change

Three triggers tell you this layout has run its course:

1. The owner is releasing more than about 30 payments a week. At that point the approval step becomes a rubber stamp, and you need a controller or finance lead holding it instead.
2. You add a second entity or a second bank. Now reconciliation and intercompany entries create new places to hide things.
3. The bookkeeper's reconciliation becomes the only review. If the owner stops reading statements because "she's always fine," the compensating control is gone and the matrix is fiction.

That's usually when firms bring in a fractional controller or a fractional CFO to own approvals and monthly review. Bennett's view is that the right person for that job isn't whoever's cheapest. It's whoever isn't already recording the transactions.

For the accuracy side of the same problem, how to maintain accounting accuracy covers the reconciliation and review cadence that keeps the books trustworthy for reasons other than fraud.

Copy the matrix above, fill in your own names, and circle every row where one person has two letters. Each circle needs a compensating control with an owner and a date. If you circle more than three, a Leak Check can help you decide which gap to close first based on where the most cash moves.