Segregation of duties for a small team: where the second check goes
In a small business, one bookkeeper often prepares the weekly payment run, releases it from the bank and later reconciles the account. Each step may be done carefully. The same arrangement also lets one person send a payment nobody approved and keep it out of sight at reconciliation. Segregation of duties puts a different person at the point in that chain where an error or improper payment would show. Where a small team cannot separate every task, the fix is a review specific enough to find the problem, not a second signature on a total.
Map who can do what
List who can approve spending, prepare a payment batch, release money, record the transaction and review the resulting bank movements. Two people may share several of these. The combinations that matter are those letting one person both move money and hide the result. Check that bank and accounting system permissions match the roles on paper. A written policy cannot stop a preparer releasing their own batch if the bank login allows it, and shared credentials undo any split.
Where the guidance applies
The US Government Accountability Office's Green Book, published on 15 May 2025 and effective from fiscal year 2026, asks management to separate incompatible duties where practical and to design alternative controls where staff are too few. It also says segregation cannot eliminate the risk of collusion or management override (paragraphs 10.21 to 10.23). The June 2026 FISCAM audit manual from GAO and CIGIE takes the same approach for information systems: identify incompatible duties by risk, separate them where possible and use alternative controls where they cannot be separated. These are US federal control and audit frameworks, not a legal checklist for a private company.
The Charity Commission's CC8 guidance, last updated on 27 November 2024, applies to charities in England and Wales. It calls for split duties, proper payment authorisation, monthly bank reconciliations reviewed by a second person, written authority limits and regular monitoring of controls. The workflow below is our practical application of their principles.
A two-person payment run
In this hypothetical, a bookkeeper prepares a £12,000 weekly batch and keeps the invoice support. The owner checks the invoices against the exact release list, payee by payee and amount by amount, then releases the batch with separate credentials. Approving the £12,000 total without the underlying items would check almost nothing. If the system lets the preparer edit a batch after approval, the release step must cover that too. An owner approving their own unapproved spending is not an independent check. The £12,000 shows a batch size, not a threshold.
| Stage | Who | What they check |
|---|---|---|
| Prepare batch | Bookkeeper | Invoice support for each payment |
| Approve and release | Owner, with own credentials | Each payee and amount on the release list against the invoices |
| Record and reconcile | Bookkeeper | Bank to ledger |
| Review the reconciliation | Owner or another named reviewer | Bank statement obtained directly, payments against the approved list, old reconciling items |
Making the compensating review work
Because staff are limited, the bookkeeper also reconciles the bank. The reviewer therefore gets the bank statement straight from the bank, not from the bookkeeper. They compare actual payments, recipients and amounts with the approved list, investigate anything unapproved or unusual, and challenge reconciling items that have been open too long. They date the review and record what happened to each exception. A ticked 'reviewed' box or a signature under an unexplained difference shows none of this. Timing and coverage should follow the business's payment risks.
A review after payment detects a loss but does not reverse it, so it is weaker than stopping an improper release. Two people acting together, or an owner overriding the process, can still defeat it.
Write it down
For each stage, name who does it, who checks any unavoidable overlap, what evidence that person sees and who covers holidays and absences. Record any emergency override and review it afterwards. Then ask of each check: could it find the specific error or unauthorised payment it is there to catch?