Guide
What Segregation of Duties Means in AP
By Keelstar Team · Updated June 1, 2026
The short answer
Segregation of duties means no single person controls the full payment cycle — vendor setup, invoice approval, and payment release should be split so fraud and errors require collusion. In AP, that means different people (or role-enforced steps) handle intake, approval, and disbursement, with an auditable trail for each.
The AP duties to separate
Classic fraud schemes need one person to create a fake vendor, approve invoices, and pay them. Splitting those duties raises the bar.
- Vendor master: create and change vendor records and banking
- Purchase authorization: PO or contract ownership
- Invoice approval: confirm goods or services and budget
- Payment: release funds and reconcile bank
What good separation looks like
The employee who approves a utility bill should not be the only person who can change the utility company's ACH details. The AP clerk who enters invoices should not approve them unless your matrix explicitly allows low-dollar exceptions with secondary review.
SOX and private company reality
Public companies under SOX document and test these controls. Private companies face the same fraud risk without the filing burden. Investors, lenders, and acquirers diligence AP controls — weak segregation surfaces in quality of earnings reviews.
Compensating controls for small teams
When one person wears multiple hats, add mitigations: management review of payment runs, dual approval on vendor bank changes, automated three-way match, and monthly analytic review of new vendors and duplicate invoices. Document compensating controls — auditors accept them when well designed.
Implement in software, not policy alone
A policy that says 'no self-approval' fails if the tool allows it. Enforce duties in the approval workflow: block self-approval, require second approver on vendor changes, log overrides. The trail should show who did what, not who was supposed to.
Frequently asked questions
- Is segregation of duties required for private companies?
- It is a core internal control expected by auditors and investors even when SOX does not apply literally. Banks and customers may require it contractually.
- How do small teams segregate duties?
- Use role separation in software, owner vs approver on invoices, and management review of payments — document compensating controls when headcount is limited.
Related guides
Put this into a monitored workflow
Invoice Approval handles this continuously — with reminders and an audit trail.