Every payment had a signature. Every expense had a voucher, an approval stamp and supporting documents. On a compliance checklist, the company scored well. But an internal audit review found that for certain transactions, the same person was initiating, approving and recording them. Approvals existed, but they were not independent. This article explains why segregation of duties and maker-checker controls matter more than the number of signatures, which role combinations are dangerous, how internal audit should test them and how to fix gaps in small and growing businesses.
Segregation of duties means no single person controls all stages of a transaction: initiating, approving, recording and handling the related asset. A maker-checker control adds an independent second person who reviews and authorises what the first person prepared. Internal audit tests both the approval policy and actual ERP access rights, because approvals that one person can bypass or perform alone provide little real control.
Why an approval is not the same as a control
An approval is only valuable if the approver is independent of the person who prepared the transaction and has the information to question it. When the same person raises a purchase request, approves it, books the invoice and releases the payment, the signature on the voucher proves only that the person agreed with themselves.
Section 134(5)(e) of the Companies Act, 2013 describes internal financial controls as the policies and procedures a company adopts for the orderly and efficient conduct of its business, including safeguarding of assets, prevention and detection of frauds and errors, and accuracy and completeness of accounting records. Segregation of duties is one of the most basic ways to achieve those objectives. The Audit Committee is expected to evaluate internal financial controls under Section 177(4)(vii), and the statutory auditor reports on them under Section 143(3)(i) where applicable.
The point is not bureaucracy. It is design. A process with fewer approvals but proper separation is usually stronger than a process with many signatures from the same small group.
The four functions that should be kept apart
When any two of these sit with one person, an error or a misappropriation can be made and concealed by the same individual. The most dangerous combination is custody plus recording, because the person who controls the asset can also adjust the books to hide a shortfall.
Common segregation of duties conflicts
| Process | Conflicting roles | What can go wrong |
|---|---|---|
| Purchases and payments | Creating or editing vendor master and approving payments | A fictitious vendor or changed bank account receives payments |
| Purchases and payments | Raising purchase orders and recording goods receipt | Payment for goods never received |
| Sales | Approving credit notes and collecting cash from customers | Collections diverted and covered by credit notes |
| Payroll | Adding employees and processing salary payments | Ghost employees on the payroll |
| Treasury | Preparing payment files and authorising them in net banking | Unauthorised transfers |
| Accounting | Posting manual journals and approving them | Unsupported adjustments to profit or balances |
| Inventory | Store custody and stock record adjustments | Stock shortages written off without investigation |
How internal audit should test approval controls
Testing approvals means testing both the design on paper and the reality in the system.
- Read the delegation of authority. Obtain the approval matrix or delegation of authority and check it is approved, current and covers all major transaction types.
- Map roles to people. For each key process, list who initiates, approves, records and reconciles. Identify any person appearing in more than one conflicting role.
- Extract ERP access rights. Download user-role and permission reports. Compare with the segregation of duties matrix to find users with conflicting access, including dormant and shared IDs.
- Test actual transactions. From system logs, identify transactions where the creator and approver user IDs are the same, or where approval was given after posting.
- Check overrides. Review how often approvals were bypassed, given after the event or given by email outside the system.
- Assess compensating controls. Where separation is not possible, check whether an independent review (for example, monthly owner review of all payments) exists and works.
Ask IT for the access report directly from the system, not a list prepared by the finance team. The point of the test is to see what users can actually do, which is often more than their job description says.
Red flags in approvals and access
- Generic or shared user IDs such as "accounts1" or "admin" used for posting.
- The same user ID as maker and checker on payments, journals or credit notes.
- Approvals dated after the payment or posting date.
- Many transactions just below an approval threshold.
- One trusted employee who "handles everything" and rarely takes leave.
- Net banking authorisation tokens or OTPs held by the person who prepares payments.
- Ex-employees or transferred staff whose system access is still active.
- Vendor bank account changes made without independent verification.
Where segregation failures lead to an actual fraud, reporting obligations may follow. Under Section 143(12) of the Companies Act, 2013 read with the related rules, a statutory auditor who has reason to believe an offence of fraud is being committed against the company by its officers or employees must report it, to the Central Government where the amount is ₹1 crore or more, and otherwise to the Audit Committee or board. Internal audit should escalate suspected fraud promptly rather than holding it for the periodic report.
Illustrative example: the trusted accountant
A mid-sized trading company has one senior accountant who creates vendors, books purchase invoices, prepares the payment file and, because the director is often travelling, also holds the net banking authorisation token. Every payment voucher carries the director's signature, added in a weekly batch after payments are released.
Internal audit extracts the vendor master change log and finds that bank details for three regular vendors were changed in the year. Payments of ₹2.4 lakh, ₹3.1 lakh and ₹1.9 lakh (₹7.4 lakh in total) went to the new accounts. Two of the three vendors later chased the company for unpaid dues.
The approvals were real, but they came after the money had gone, and the person approving never saw the vendor master changes. The fix was not more signatures; it was separation: vendor master edits moved to a different person with call-back verification, the director took back the authorisation token, and a weekly payment register review was introduced before release.
Segregation of duties in small teams
Smaller companies often say they cannot afford separation because the finance team is two or three people. Full separation may not be possible, but meaningful separation usually is:
- Keep payment authorisation in net banking with an owner or director, even if preparation sits with the accountant.
- Have someone other than the accountant receive bank statements directly and review them.
- Lock vendor master changes so they need a second user to approve, which most accounting software supports.
- Use a monthly owner review of all payments above a set amount, journals, credit notes and vendor changes as a compensating control.
- Rotate duties or enforce leave, so that another person handles the work for a period.
Investors notice these points too; see our note on controls and governance signals in due diligence.
Approval and segregation of duties checklist
- Approved delegation of authority covering purchases, payments, credit notes, journals, payroll and master data.
- Segregation of duties matrix for each key process, identifying conflicting role pairs.
- ERP user access report extracted by IT and reviewed against the matrix at least annually.
- No shared or generic user IDs for posting or approval.
- System enforces different maker and checker for payments, journals and credit notes.
- Vendor and employee master changes approved by a second person with independent verification of bank details.
- Net banking authorisation separate from payment preparation.
- Access removed promptly for exits and transfers.
- Compensating reviews documented where separation is not practical.
- Approvals checked for timing (before, not after, the transaction).
- Findings and actions reported to the Audit Committee and tracked to closure, as described in our internal audit and corporate governance guide.
Frequently asked questions
What is segregation of duties in accounting?
Segregation of duties means dividing the authorisation, custody, recording and review of transactions among different people, so that no single person can both make and conceal an error or fraud. It is a core element of internal financial controls.
What is a maker-checker control?
In a maker-checker control, one person prepares or enters a transaction and a second, independent person reviews and authorises it before it takes effect. Many ERPs and banking platforms can enforce this by requiring different user IDs for each step.
How does internal audit test segregation of duties?
Internal audit compares the approved roles with actual system access, identifies users with conflicting permissions, and analyses transaction logs for cases where the same user created and approved an entry. It also checks whether approvals were given before the transaction.
What if a small company cannot separate duties fully?
It should use compensating controls, such as keeping bank authorisation with the owner, independent review of bank statements, second-person approval of vendor master changes and a monthly review of payments, journals and credit notes.
Is segregation of duties required under the Companies Act?
The Act does not list specific role separations, but Section 134(5)(e) describes internal financial controls that include prevention and detection of frauds and errors. Segregation of duties is a standard way to meet that objective and is reviewed when internal financial controls are assessed.
How often should ERP user access be reviewed?
At least annually, and also whenever there are role changes, exits or system upgrades. Higher-risk companies often review access for finance and treasury roles every quarter.
Conclusion
Approvals give comfort only when they are independent. A control system where one person can initiate, approve and record a transaction depends entirely on that person's honesty and accuracy. Clear role separation, maker-checker settings in the ERP, controlled master data and regular access reviews turn approvals into real control. In short, an approval is only as strong as the independence behind it.
Need a fresh look at your internal controls?
H K Davra & Co. supports companies with risk-based internal audit, internal financial controls testing and Audit Committee reporting.
Talk to usThis article is for general information only and does not constitute professional advice or solicitation. Examples are illustrative. Provisions are summarised as of October 2026. Please refer to the relevant provisions and seek advice on your specific facts.