# Segregation of Duties in a Small Business With Two People

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Internal controls over cash
- Canonical: https://precisebankflow.com/blog/segregation-of-duties-in-a-small-business

> Segregation of duties in a small business with one or two staff: compensating controls, owner review and what to do when duties cannot be split.
Segregation of duties in a small business means no single person can both move cash and hide that it moved. With two people, the bookkeeper records and prepares payments while the owner approves, releases and reviews the bank statement. When even that split is impossible, owner review and bank-side controls take its place.

## Which cash duties need splitting in a small business?

Four cash duties need splitting in a small business: custody, approval, recording and reconciling. Custody is physical or online access to the money. Approval is the decision that a payment should happen. Recording is entering it in the books. Reconciling is proving the books agree with the bank. Trouble starts when one person holds two of them.

### The four duties, in plain terms

- **Custody** covers anyone who can touch the money: the person who takes deposits to the bank, holds the checkbook, or has a login that can send an ACH payment or a wire.
- **Approval** covers anyone whose say-so makes a payment legitimate: signing a check, approving a bill in the payables system, or authorizing a refund.
- **Recording** covers anyone who can enter, edit or delete transactions in the accounting file, including vendor and customer records.
- **Reconciling** covers whoever compares the bank statement to the ledger each month and explains the difference.

### The pairs that cause losses

Not every combination is equally dangerous. The pairs below are the risky ones, because each lets the same person create a payment and then make it look normal.

| Duties held together | What one person could do | How it would look in the books |
| --- | --- | --- |
| Custody and recording | Pocket a customer check and mark the invoice as written off | A bad-debt entry with no collection effort behind it |
| Approval and custody | Pay a vendor they set up themselves | An ordinary-looking bill paid on time |
| Recording and reconciling | Send a payment to themselves and code it to supplies | A reconciliation that balances perfectly |
| Custody and reconciling | Remove cash and explain the gap as a timing item | A deposit in transit that never clears |

The pair to break first is recording plus reconciling. A person who keeps the books and also proves them against the bank can hide almost anything, because the one check designed to catch errors is under their control.

## A two-person duty matrix: owner and bookkeeper

A two-person duty matrix assigns each cash task to either the owner or the bookkeeper so that no task chain runs start to finish through one person. The usual pattern is that the bookkeeper prepares and records, and the owner approves, releases payments and reviews the bank activity. The table below is an example to adapt.

The values here are illustrative. A business with a different payment mix, such as mostly card receipts or mostly cash sales, will move a few rows, but the logic stays the same.

| Cash task | Owner | Bookkeeper | Compensating control if it cannot be split |
| --- | --- | --- | --- |
| Open mail and log incoming checks | Yes | | Bank lockbox or remote deposit by the owner |
| Prepare the bank deposit | | Yes | Owner compares the deposit log to the statement |
| Enter customer payments in the books | | Yes | Owner reviews the aged receivables quarterly |
| Add or change a vendor record | Approves | Enters | Report of vendor changes reviewed monthly |
| Enter bills for payment | | Yes | Owner sees the payment run before release |
| Approve and release payments | Yes | | Bank dual approval on online payments |
| Sign checks | Yes | | Bank alert for any check above a set amount |
| Run payroll | Approves | Prepares | Owner compares payroll totals to the bank debit |
| Receive the bank statement | Yes | | Statement sent to the owner's own email |
| Prepare the bank reconciliation | | Yes | Owner reviews the reconciliation and signs it |
| Review the bank reconciliation | Yes | | Outside accountant reviews it quarterly |

### Reading the matrix

Each row has one person who does the work and, where needed, another who approves it. Look down the bookkeeper column: every item there is either something the owner later sees or something the bank later reports. Look down the owner column: those are the points where money actually leaves, plus the evidence that it left correctly.

The owner gets the bank statement directly. That single row does more work than any other. If the bookkeeper is the only person who sees the statement, every other split in the table can be undone quietly.

## Compensating controls when one bookkeeper does everything

Compensating controls are checks that do not prevent a bad payment but make it likely to be found quickly. They matter most when one bookkeeper handles every cash task and the owner has no time to take any of them over. The goal shifts from stopping fraud to shortening how long it can run unseen.

### Controls the bank can run for you

Banks offer several services that act like a second employee. Positive pay compares each check presented against a file of checks you actually issued, and returns the rest for a decision; [what positive pay is and how its exception decisions work](/blog/what-is-positive-pay) covers it in detail. Other options to ask your bank about:

- Alerts by text or email to the owner for any outgoing payment above a set amount.
- Dual approval on ACH and wire payments, where one login creates the payment and a second login releases it.
- Read-only online access for the owner, so the statement and daily activity are always visible.
- A block on ACH debits from companies you have not authorized.

### Controls inside the books

The accounting file can also report on itself. Most accounting systems can produce an audit trail or a list of changes. A monthly look at three reports catches most tampering:

1. New and changed vendors, with the bank details that changed.
2. Voided, deleted or backdated transactions.
3. Journal entries to cash made by anyone other than the normal payment process.

The owner does not need to understand every entry on these reports. The owner needs to ask about anything that looks unfamiliar and expect a clear answer.

### Mandatory time away

A bookkeeper who never takes a day off is a known warning sign, because many schemes need constant attention to stay hidden. Requiring a full week or two away each year, with someone else doing the work and opening the mail, is one of the cheapest compensating controls a small business has.

## What should the owner's monthly bank statement review cover?

The owner's monthly bank statement review should cover every outgoing payment by payee, the check images, transfers to other accounts, and the ending balance against the reconciliation. It takes about fifteen minutes for a business with a few hundred transactions. The point is to see the money with your own eyes before anyone explains it.

### What the review must include

In a two-person business, the review is the owner's half of the duty split, so two items matter more than the rest. The owner opens the statement from the bank, never from a copy the bookkeeper forwards, and compares its ending balance with the bookkeeper's reconciliation before initialling and dating it. A minute-by-minute version, covering payees, check images, transfers and payroll, is in [owner review of bank statements in 15 minutes](/blog/owner-review-of-bank-statements#getting-the-bank-statement-before-anyone-else-sees-it).

The bookkeeper's reconciliation is easier to review with a list in hand. [The bank reconciliation review checklist](/blog/bank-reconciliation-review-checklist) sets out what to tie to the source and what to send back.

### Why the timing of the review matters

Reviewing within days of the statement date is not just good practice. Under the Uniform Commercial Code, a bank customer must examine statements with reasonable promptness and report forged signatures or altered checks; [section 4-406 of the UCC, published by Cornell's Legal Information Institute](https://www.law.cornell.edu/ucc/4/4-406), also bars a customer who misses those duties from contesting later items by the same wrongdoer after a period of up to 30 days. A business that reviews late can lose its claim against the bank for checks it could have stopped.

## Owner sign-off without looking: the segregation failure that hides fraud

Owner sign-off without looking is the most common way segregation of duties fails in a small business. The duties are split on paper, but the owner signs whatever is put in front of them. A signature from someone who did not read the page gives the bookkeeper cover and gives the business nothing.

### What a rubber stamp looks like

The pattern is easy to recognize once you name it:

- The owner signs blank checks before a trip "so bills get paid on time."
- The owner approves the payment run in the banking app from a phone notification, without opening the list.
- The reconciliation arrives already initialed by the owner, because the bookkeeper "always does that part."
- The owner's online banking token sits in the bookkeeper's drawer.

Each of these hands the approval duty back to the person doing the recording. The matrix still says the owner approves, but in practice one person runs the whole chain.

### A short worked example

Here is an illustrative case. A bookkeeper at a small contractor adds a vendor called "JM Supply" with a bank account she controls. Each month she enters an invoice for 1,840.00 and includes it in the payment run. The owner approves the run from his phone each Friday and never opens the detail. The bank reconciliation balances every month, because the payments are real and recorded.

The scheme would show up in any of three places: the vendor change report, a scan of payees on the statement, or a question about why a supply vendor has no address. None of them ran. Fraud techniques such as duplicate and trend testing would also flag a new vendor with identical monthly amounts; [fraud detection techniques in forensic accounting](/blog/fraud-detection-techniques-in-forensic-accounting) explains how those tests find patterns like this one after the fact.

### Fixing it without hiring

The fix is behavioral, not structural. The owner opens the payment list before approving, keeps the banking token personally, and never signs a blank check. If that takes too long, the payment run is too large for one approval, and a lower threshold for owner review is the answer.

## Can a bank or outside accountant take over segregated duties?

A bank or an outside accountant can take over some segregated duties, which is often the cheapest way to add a second person. The bank can handle custody tasks such as receiving checks and screening payments. An outside accountant can take the reconciling or reviewing duty, so the person who records cash is never the person who proves it.

### Tasks a bank can absorb

- **Receiving checks**: a lockbox service collects customer payments and deposits them, so no employee handles incoming checks.
- **Screening checks and debits**: positive pay and debit blocks stop items you did not issue or authorize.
- **Second approval**: dual control on online payments puts the release of money behind a second login.

### Tasks an outside accountant can absorb

- Preparing or reviewing the monthly bank reconciliation.
- Reviewing the vendor list and changes to it each quarter.
- Running a year-end review of payees, payroll and owner draws.

An outside reviewer works best with data they can check quickly. A reconciliation tool such as [PreciseBankFlow](/) reads the statements, confirms each one foots from opening to closing balance, and lists duplicates and gaps for the reviewer to question, which turns a quarterly review into a list of specific items rather than a stack of PDFs.

### When outside help is not enough

An outside accountant who sees only what the bookkeeper sends is not independent. The statements must come straight from the bank, either by the accountant's own read-only login or by the owner forwarding them unopened. If the outside reviewer depends on the bookkeeper for the source documents, the duty has not really moved.