Segregation of duties separates four major responsibilities within each business process: authorizing transactions, custody of assets, recording transactions, and reconciliation or verification. Performing more than one of these is considered performing incompatible duties. Ideally, no single employee holds two or more.
Staffing limitations often make that impractical. That is precisely when compensating controls must be considered — not when the concept is abandoned.
Where optimum separation cannot be achieved, aim for an acceptable minimum: verify that no one employee performs more than two of the incompatible duties. An employee might, for example, perform authorization and verification/reconciliation, but should not also record the transaction or maintain custody of assets. Managerial review then serves as the compensating control.
Some practical baselines. The chief financial officer, controller and accounting personnel generally should not be able to modify general ledger accounts or change account mappings; those changes belong with IT personnel after approval. Employees who prepare or initiate a journal entry should not also approve or record it. Financial statements should be approved by supervisory personnel at a higher authority level than the preparer.
If the general ledger system cannot require approval before posting, a compensating control is to print a report of all journal entries at period end and have a supervisory employee without recording access review and approve what was posted.
Matrices covering the most common processes — cash, petty cash, investments, purchasing, payroll, inventory, fixed assets and general ledger — are available on request to help structure separation of duties and identify where it is lacking.
This article is general information for nonprofit leaders and is not legal, accounting or tax advice. Requirements change; confirm current guidance for your organization's fiscal year before acting.
Have a question about this?
Marifran will tell you plainly whether the issue needs attention now or at the next reporting cycle.
Speak with Marifran