Segregation of duties testing checks whether any one person can both initiate and conceal an error or a fraud across a transaction cycle — for example, creating a vendor master record and also approving payment to that vendor. Testing it properly means pulling actual system access rights rather than relying on an org chart, identifying every person who holds conflicting access, and then assessing whether a compensating control, such as an independent review, closes the gap the access conflict leaves open.
The classic conflicts, and why they matter
Segregation of duties exists to prevent one person from controlling a transaction from end to end, because a single point of control is a single point where an error goes uncaught or a fraud goes unconcealed by anyone else's involvement. The conflicts that recur across almost every mid-market audit sit at the seams between initiation, custody, recording and approval.
| Cycle | Classic conflict | What it enables if unchecked |
|---|---|---|
| Procure-to-pay | Same person creates or amends the vendor master and approves payment to that vendor | A fictitious or controlled vendor can be created and paid without a second person ever seeing both ends of the transaction |
| Procure-to-pay | Same person raises the purchase requisition and approves it | Unauthorised or inflated purchases pushed through with no independent approval |
| Order-to-cash | Same person records a sale and also has authority to write off the corresponding receivable | Revenue can be recorded and later quietly removed without anyone questioning the write-off |
| Cash and banking | Same person prepares the bank reconciliation and also has payment initiation or cheque-signing authority | A reconciliation can be made to tie out even when it is hiding an unauthorised payment |
| Payroll | Same person maintains employee master data and processes the payroll run | Ghost employees or unauthorised pay changes processed and paid without independent check |
| General ledger | Same person posts manual journal entries and also has authority to approve their own journals | Any adjustment, including one designed to misstate the financials, can be posted and approved by one person |
Testing it with data, not assumption
An org chart or a policy document describing who is supposed to do what is not evidence of who actually can do what in the system. The only reliable source is the access rights extract from the ERP or accounting system itself, cross-referenced against the roles and permissions actually assigned.
- 01Pull the user access listing directly from the systemEvery active user, every role assigned, and the transaction codes or menu permissions each role actually grants — not a summary prepared by the client describing what access is 'supposed' to look like.
- 02Define the conflict matrix for the entity's cyclesList the specific pairs of functions that should never sit with one person — vendor master maintenance and payment approval, journal posting and journal approval, and so on, tailored to how this entity's system is actually configured.
- 03Match users against the conflict matrixIdentify every user who holds both sides of a defined conflict. In a smaller ERP this can be done directly against the access listing; in a larger one, access review tools or a script against the extracted role data does this faster and more completely than manual review.
- 04Verify the access is actually used, not just grantedA dormant conflicting access right assigned by default at setup and never exercised is a lower-priority finding than one actively used. Transaction logs, where available, show whether the access was exercised during the period.
- 05Trace a sample of transactions where a conflict exists back to sourceFor users holding a genuine conflict, pull a sample of the transactions they actually processed and check whether a second person's review is evidenced anywhere in the trail.
When the team is too small for perfect separation
In a four- or five-person finance function, textbook segregation is often not achievable without hiring people the business does not otherwise need. Flagging every conflict as a finding without acknowledging this reality produces a report management will not take seriously. The more useful question is not whether a conflict exists, but whether something independent compensates for it.
- An independent review after the fact — someone outside the conflicted pair, even a director or the owner, periodically reviewing a sample of the affected transactions.
- A system-generated exception report that flags unusual activity by a conflicted user — a vendor created and paid within the same day, for instance — reviewed by someone else.
- Rotation of duties over time, even if not continuously separated, so the same person is not permanently the only check on their own work.
- External confirmation procedures that catch the kind of error or fraud the conflict would otherwise enable — vendor statement confirmations, for example, as a check on vendor master integrity.
Common practice, not a requirement
A compensating control is only as good as its own evidence trail. 'The owner reviews everything' is not a compensating control unless there is something to show the review actually happened — a signed report, a dated log, an email — on a recurring basis, not just as a general statement of comfort.
Do not accept a compensating control that is itself performed by someone in the conflicted pair, or by someone who reports to them. Independence is the entire point; a review by a subordinate of their own manager's conflicted transactions compensates for nothing.
Documenting the finding
The working paper should record the conflict identified, the users affected, whether the access was actively exercised, the compensating control if one exists and evidence it operated, and a graded conclusion — not a flat finding that treats a dormant access conflict covered by a strong compensating control the same as an active, uncompensated one.
How we think about this
Matching a user's access rights against a conflict matrix across hundreds of users and dozens of roles is exactly the kind of exhaustive, rule-based comparison that should never be done by eyeballing a spreadsheet. The part that still needs a person is judging whether a given compensating control, in this specific small team, actually closes the gap — and that judgement should be made with the full, matched list in hand, not a sample of it.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCBuilding a risk control matrix (RCM) for audit testingHow to structure an RCM so it actually drives testing, map it to financial statement assertions, and stop it from becoming the document nobody updates after the first year.
- Internal audit & IFCControl walkthrough documentation: what belongs in the fileWhat a control walkthrough has to establish beyond description, narrative versus flowchart formats, and the shortfalls that recur most often on file inspection.
- Internal audit & IFCIFC testing: internal financial controls over financial reportingHow IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
- Internal audit & IFCFraud risk assessment: building it into the audit planThe fraud triangle applied practically rather than as theory, why management override is a presumed risk on every engagement, and what journal entry testing is actually looking for.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.