Finance Operations and Controls
Separation of Duties: A Simple Control Every Business Should Use
No one person should raise, approve and pay the same transaction. How separation of duties works in a five-person finance team, where it usually breaks, and the honest compromises when you don't have enough people.
Separation of duties is one idea: the person who starts a transaction isn't the person who finishes it. Someone raises, someone else approves, and ideally a third person pays or records. It costs almost nothing to set up, and it stops most of the expensive mistakes, honest and otherwise, that finance teams find too late.
The four jobs in every transaction
Every money movement has four jobs inside it. Separation means no single person holds all of them for the same transaction.
| Job | Invoice example | Payment example |
|---|---|---|
| Initiate (the maker) | Billing officer raises the invoice | Operations manager requests diesel for the depot |
| Approve (the checker) | Accountant reviews; MD approves if it's large | Accountant reviews; MD approves |
| Execute | System emails it to the customer | Finance makes the transfer |
| Record and reconcile | Payment matched to invoice | Bank statement reconciled to the voucher |
The classic split is between maker and checker. If you do nothing else, do that.
Why it works
Separation catches three kinds of problem:
- Honest error. A second person reads the invoice and spots that the rate is ₦100,000 per trip, not ₦1,000,000.
- Convenience shortcuts. "I'll approve my own voucher this once; Tunde is travelling." Once becomes monthly.
- Fraud. One person can't invent a supplier, raise a voucher to it and approve the payment, because two people would have to agree.
It also protects the people doing the work. When a payment is queried a year later, the accountant isn't the only name on it.
Where it usually breaks
- Shared logins. If Chiamaka and Bola share one password, the system can't tell maker from checker. Every user needs their own login.
- The urgent exception. Approvals bypassed "just this once", over WhatsApp. If it isn't recorded, it didn't happen.
- Approving your own edits. The checker edits the invoice and then approves it. Edits by the approver should send it back for a fresh review.
- Master data. Whoever can add a supplier's bank account shouldn't also approve payments to it. This is the weak point fraudsters look for.
- The owner who does everything. In a founder-led business the MD raises, approves and pays. That's a risk to the business, even when nobody means harm.
A worked example in a five-person team
Adebayo & Co. Logistics in Ikeja runs its finance with five people:
| Person | Role | Can raise | Can approve | Can pay |
|---|---|---|---|---|
| Bola Adeyemi | Billing officer | Invoices | — | — |
| Ifeanyi Okeke | Operations manager | Vouchers | — | — |
| Chiamaka Obi | Accountant | Vouchers (with a second approver) | First review of invoices and vouchers | Records payments |
| Aisha Bello | HR & payroll | Pay runs | — | — |
| Tunde Bakare | MD | — | Final approval above ₦1,000,000; pay runs | Releases bank payments |
Three rules make this work:
- Nobody approves what they raised. When Chiamaka raises a voucher herself, Tunde approves it.
- Above ₦1,000,000, two approvals. Chiamaka reviews and Tunde gives final approval.
- The payer isn't the requester. Tunde releases the payment, but he never raises vouchers.
When you don't have enough people
Small teams can't always separate everything. The honest compromises are:
- Compensating review. If one person must raise and pay, someone else reviews the bank statement against the vouchers every week, and signs it off.
- Thresholds. Let small items move with one approval, and require two above a limit you'd be uncomfortable losing.
- External eyes. An outside accountant reviews the month's payments and approvals before the close.
- Visibility for the owner. A weekly list of every payment, sorted by amount, reviewed by the MD. It takes ten minutes.
What doesn't count as a compromise: a policy document nobody follows.
A quick self-check
Answer yes or no:
- Does every person who handles money have their own login?
- Can anyone approve a transaction they raised? (The right answer is no.)
- Do large payments need a second approval?
- Is adding or changing a supplier's bank account controlled separately from approving payments?
- Is every approval recorded with a name and a time?
- Does someone other than the payer reconcile the bank each month?
Two or more "no" answers means the control exists on paper only. Our guides to approval workflows and payment vouchers show how to fix the gaps.
How Flux helps
Flux builds separation of duties into its approvals. The person who raises an invoice sends it to an accountant for review, and an optional final approval applies above your naira threshold. Roles and permissions, including an invoice approver role, control who can do what. Vouchers and pay runs have their own approval steps, and the audit log records each one. See how approvals work.