What are the functions that should be segregated?

The segregation of duties is the assignment of various steps in a process to different people. The intent behind doing so is to eliminate instances in which someone could engage in theft or other fraudulent activities by having an excessive amount of control over a process. In essence, the physical custody of an asset, the record keeping for it, and the authorization to acquire or dispose of the asset should be split among different people.

The segregation of duties is an essential element of a control system. Auditors will look for duty segregation as part of their analysis of an entity's system of internal controls, and will downgrade their judgment of the system if there are any segregation failures. When there are segregation failures, the auditors will assume that there is an expanded risk of fraud, and adjust their procedures accordingly. This change in procedures usually involves in increase in the amount of audit work, which is passed through to the client in the form of higher audit fees.

The segregation of duties is more difficult to accomplish in a smaller organization, where there are too few people to effectively shift tasks to different people. Another issue with segregation is that shifting tasks among too many people makes the process flow less efficient. When a higher level of efficiency is desired, the usual trade-off is weaker control because the segregation of duties has been reduced.

Examples of Segregation of Duties

As an example of the segregation of duties, the person who receives goods from suppliers in the warehouse cannot sign checks to pay the suppliers for those goods. As another example, the person who maintains inventory records does not have physical possession of the inventory. And as a third example, the person who sells a fixed asset to a third party cannot record the sale or take custody of the payment from the third party.

The basic transaction stages include recording (initiate, submit, process), approving (pre-approval and post-entry review), custody, and reconciling. No one person should initiate, authorize, record, and reconcile a transaction.

Purpose

All organizations should separate incompatible functional responsibilities. Proper segregation of duties helps ensure that errors, omissions, or misstatements, whether intentional or unintentional, will be detected by another person. Where segregation of duties is not possible or practical, deploy alternative controls.

Key Concepts and Control Examples

Address Unit Differences:

Segregation of duties may vary depending on a unit's size and structure. 

Control Example: Duties may be segregated by department or by individuals within a department. Consider the level of risk associated with a transaction when determining the best way to segregate duties.

Demonstrate Segregation of Duties: 

It should be possible to demonstrate segregation of duties to an outside party.

Control Example: Procedures and authorizations are documented to prove that a system of control includes segregation of duties.

Document Responsibilities:  

Segregation of duties should be clearly defined, assigned, and documented.

Control Example: Document and clearly communicate who will initiate, submit, process, authorize, review, and reconcile each activity within the unit.

Increase Review and Oversight:  

When it is difficult to sufficiently segregate duties, unit management should increase review and oversight functions.

Control Example: Assess the potential for mistakes or fraudulent transactions. If the segregation of duties is not sufficient to eliminate or adequately reduce the risk of discovering errors, the level of management’s review should be increased over that particular activity.  

Rotate Job Duties: 

Unit management should rotate key internal control responsibilities to enhance segregation of duties and identify potential lapses.

Control Example: Rotating key job duties, such as responsibility for reconciling bank accounts or approving transactions, offers the opportunity to determine whether a control is functioning as intended, and it is an opportunity to cross-train others to perform those functions.

For proper segregation of duties (SOD) to exist, the company should ensure that an individual employee does not have access to more than one responsibility that relates to authorization, record keeping or custody of assets.

For example, an employee should not have the ability to write checks and also record cash disbursements in the accounting records. If the employee had both duties, then the employee could write checks to anyone they wanted and fictitiously record the disbursement as an expense in the normal course of business!

Previous Question

Next Question