Separating Duties in a Shop With Four People

Why this matters

Every control article you will ever read assumes you have staff to spread the work across. You have four people, one of whom is you, and the person who opens the mail also enters the invoices, records the payments, and produces the report you read to check on all three. That is not sloppiness, it is arithmetic. The standard advice is useless to you because it starts by assuming your problem away.

The useful version is different. You cannot split four functions across two office bodies, so you buy the separation somewhere other than headcount. This card is that design, and the rest of this group cites it rather than re-deriving it.

One thing before the mechanics, because the failure mode of this material is paranoia. A shop run on suspicion loses more to disengagement than it ever loses to theft. The employee a control protects most is the honest one, because when money goes missing and only one person could have touched it, a clean control is the only thing that clears them.

The four functions and the one rule that connects them

• Authorising - deciding the thing may happen. Approving a purchase, setting a price, approving a write-off, adding a vendor, changing a pay rate.
• Recording - entering it. The invoice, the bill, the payment, the parts issue, the hours.
• Custody - physically holding the asset. The cash, the card, the cheque book, the stock, the keys.
• Reconciling - comparing what was recorded against an independent source the recorder did not produce.

The rule: nobody should both create a transaction and verify it.

The word carrying the weight is independent. A bank statement is independent. A report generated from your own system, by the person you are checking, is not. Most small-shop loss is not clever. It survives because the only thing anyone ever looks at is a summary produced by the person being looked at.

Why the textbook answer does not fit you

The textbook says assign the four functions to four different people. At four people your office is one person, so recording and custody are already fused: the same hand that enters the payment also holds the cheque book. You are not going to hire a fifth person to fix a risk you have not measured.

So invert it. Instead of asking who gets each function, ask which single function, kept out of that person's hands, breaks the most schemes. That function is reconciliation, and it is the one you keep personally. Three reasons, and the third is the one that decides it.

It is the cheapest. Reconciliation is a reading task, not a processing task, and it does not sit in anyone's daily path. It is the hardest to fake, because its inputs arrive from outside the shop. And it is the only one of the four you can hold without becoming a bottleneck: if you keep authorising, every purchase waits on you being out of an attic and near a phone, and within a month you will delegate it back.

Substitute one: you take reconciliation, and you do five things

Not a review. Five specific reads, monthly, on a fixed date. At four people this is roughly 45 to 60 minutes once the habit exists. At twelve it is closer to two hours, because the samples get bigger.

1. Open the bank statement yourself, before anyone else sees it, and read the payee list line by line. Not the total, not a categorised summary. The names.
2. Compare collections recorded to deposits banked, by day, for a sample of days - five working days chosen at random, not the ones you remember.
3. Read every vendor and every employee added since last month. The list should be short enough to read in full. If it is not, that is itself the finding.
4. Compare the payroll register head count and pay rates against your own roster, which you keep, not the one in the payroll system.
5. Pull five jobs and compare parts issued against parts billed.

The failure mode is specific and common: the owner who "reviews the financials" every month and means a profit and loss statement produced by the person being separated from. A profit and loss statement cannot show you a payee. Category totals are exactly where a fictitious vendor lives, because it is a real-looking line in a real-looking category. If the only thing you do from this card is read the payee list, you have closed more exposure than a segregation chart ever would.

Substitute two: system permissions instead of headcount

This is the modern answer and the one most shops already own and have never switched on. Field-service and accounting packages now ship per-feature permission flags, usually some version of view, create, edit and delete. That lets you split functions inside one person.

The office coordinator can create an invoice and not delete one. Record a payment and not void one. See a customer and not export the list. Issue a part and not adjust a stock count. None of that needs a second body, and all of it turns a silent alteration into a request that has to come to you.

Two conditions make it a real control rather than a settings screen. The permission set has to exclude the ability to change permissions, or it is self-service. And the system has to keep history on the edit, because a record that can be changed with no trace is not controlled, it is just inconvenient to change. When you are choosing software, that second one is worth more than most of the feature list.

Substitute three: the outside bookkeeper is a genuine second party

An outside bookkeeper or CPA firm is real separation, because they are not in your building and they do not benefit from your transactions. Two cautions.

First, they only separate the function you actually hand them. If they receive a monthly file prepared by your office person and enter it, they have taken recording and the office person has kept custody plus the preparation - which is most of the risk, still stacked. The separation you want is the reverse: your office person handles the day-to-day and the outside party does the bank reconciliation and the payroll register.

Second, a tax return engagement and a compilation do not include testing your internal controls. That is not in scope unless you ask for it and pay for it separately. Owners assume for years that someone is checking. Ask directly what they check, and get the answer in writing.

Substitute four: mandatory vacation and cross-training

One consecutive full week away, and someone else does the work while they are out. The substitution is the control, not the absence: a week off during which the work piles up on their own desk detects nothing.

The banking convention this comes from is two consecutive weeks, and two is better if you can carry it. One week is the floor recommended here because at four people a fortnight without your only office person is a genuine operational problem, and a control nobody can afford to run is not a control. Take the second week when the cover exists.

This mostly detects rather than prevents, which is exactly why it is worth doing at your size. Several schemes need daily maintenance to stay invisible - lapping a receipt against the next one, holding a deposit back, keeping a fictitious vendor's paperwork ahead of the file. A week of someone else opening the mail is often the whole detection mechanism. It costs nothing, and it is the only control on this list that also solves a real operational problem, which is that at four people you have no cover when somebody gets sick.

The combinations that stay forbidden at any size

Five, and they hold at four people or at forty.

• The person who receives payments does not record them. This is the hardest one to honour in a field-service shop and the most important, because the theft leaves no hole to find.
• The person who sets up a vendor does not approve payment to it.
• The person who records payroll cannot add an employee or change a rate.
• The person holding the cheque book or the card does not reconcile the bank.
• Nobody voids, writes off or adjusts their own transaction.

If a combination on that list is currently fused, and one always is, the fix is not necessarily a body. It is usually a permission flag, plus your name on the second half.

Two worked control maps

Four people: you, one office coordinator, two techs.

Authorising and recording are fused in the coordinator for routine items, which is the compromise you are knowingly making. What makes it survivable is that the standing list is written down and bounded, and that the reconciliation of the boundary is not hers.

Twelve people: you, coordinator, dispatcher, part-time bookkeeper, eight field.

Now you can unfuse record from custody, which is the first split worth buying. The bookkeeper records. The coordinator holds the card and the cheque book and does not enter bills. The dispatcher authorises schedule and nothing that touches money. New vendor and new employee setup takes two people, with no threshold. You keep reconciliation and you keep approval above a stated limit.

Notice what did not change. You still read the payee list yourself. Adding a bookkeeper does not return that to you as a summary, it just means the summary is now produced by someone who also reconciles, which is the exposure the next card in this group is entirely about.

How to tell whether your map is real

Take the map you just wrote and test it with one question, asked of each function: if this person wanted to, could they do it and then produce the record that says they did not? Walk it, do not assume it.

Then test the reconciliation itself. If your monthly read is done from a report generated inside your own system, it is not a reconciliation and it will pass forever. The inputs have to come from outside: the bank, the supplier statement, the payroll provider, the customer.

The last test is the honest one. Count how many months in the last twelve you actually did the five reads. A control that exists on paper and runs twice a year is not a control, and the version of this card that helps you is three reads you genuinely do every month rather than five you intend to.

References

• AICPA, on the scope of preparation and compilation engagements, which do not include testing internal control
• Federal Deposit Insurance Corporation, examination guidance on internal routine and controls, the origin of the long-standing two-week mandatory-absence recommendation
• See related: Before You Accuse Anyone: The Sequence; The Bookkeeper With Too Much Access; Separating Business and Personal Finances: The Habit; Catching and Preventing Inventory Shrinkage