Segregation of Duties: The Oldest Control and Why It Still Works

Segregation of duties separates tasks that let one person both create something and confirm it. The arrangement works without asking anybody to be trustworthy: two people have to be wrong together before anything gets through. At Vindhya Commercial Bank Limited, an invented bank, one officer could both check trade finance documents and release the instrument. The gap produced incident I13, the largest net loss of the year.

Almost every control asks somebody to do something well. Check the figure. Read the clause. Follow the procedure. Notice the exception. Each of those is a request made of a person, and a request made of a person is answered differently on a quiet Tuesday and on the last afternoon of a quarter when three things are late. Segregation of duties is built the other way round. Rather than asking anybody to be careful, or honest, or awake, the control arranges the work so that one person acting alone cannot complete the thing at all. The change is small in wording and enormous in what happens when the day goes badly.

Separation is also the oldest control there is. Long before anybody wrote the word risk down, a merchant who kept the keys to the strongroom made sure somebody else kept the ledger of what was inside it. The arrangement has survived every change in technology since. A control that old is unusual enough to be worth treating on its own. The subject divides into five parts: what the control separates; which pairs of tasks are incompatible and why; what separation costs; what is done where the separation genuinely cannot be made; and the two things the control can never reach no matter how carefully it is drawn.

What does segregation of duties actually separate?

The mechanism is identical at home and the stakes there are small enough to see clearly, so start at home. Suppose one person in a household does the shopping, keeps the receipts, and is also the person who checks the receipts against the bank statement at the end of the month. Nobody in that arrangement is doing anything wrong. But notice what the monthly check is actually worth. If a receipt was written down as Rs 900/- when it was Rs 1,900/-, the person checking is the person who wrote it, and they will read it the same way the second time for exactly the same reason they read it that way the first time. The check happens. It just cannot find anything.

Now hand the statement to somebody else in the household who did none of the shopping. Nothing about the shopping has changed and no new effort has been added, beyond the few minutes of a second reading. But the check has stopped being a repeat of a judgement already made and has become a genuinely new one. Separation adds not more checking but a second and independent judgement, and the gap between those two things is the whole subject.

Segregation of dutiesA control separating tasks so that no one person can both create something and confirm it. holds two acts apart. The first act is creating something: raising an instruction, writing an entry, cutting a payment, issuing an instrument, changing a rate. The second act is confirming it: saying that the entry, the payment or the instrument is right and may proceed. Creating and confirming are done all day long in every institution, and the control is one rule about them. The two acts may not sit in the same pair of hands.

The reason is not the obvious one, so read it slowly. The reason is not that the person who creates something is likely to be dishonest. Most of the time they are not, and the control would be worth having in an institution where nobody ever was. The reason is that a confirmation given by the author of the thing being confirmed carries no information. The confirmation comes from the same mind, applying the same assumptions, to the same document, a few minutes later. Whatever the first pass accepted, the second pass accepts, and it accepts it for the same reason. A check performed by the person whose work is being checked is not a weak check, it is not a check at all, and treating it as a weak one is how it survives on a control list for years.

Which pairs of tasks are incompatible, and why those four?

Institutions usually write this control down as a list of pairs that must never sit together. Four of them do most of the work, and they look like four unrelated rules until they are set beside each other, where they turn out to be one rule wearing four coats.

The first pair is initiate and approve. Somebody raises a payment, a limit increase, a new supplier, a rate change. Somebody else says yes. If the person raising it is also the person approving it, the approval step is a formality that consumes time and stops nothing. Initiate and approve is the pair most people already know, and the other three are usually explained by it.

The second pair is execute and reconcile. Somebody sends the instruction; somebody else compares the record afterwards against an independent source and finds the differences. ReconciliationComparing a record against an independent source, which is incompatible with having executed the thing being reconciled. is where an error that got past the first two people is caught, and it only catches anything if the person doing it did not do the thing being reconciled. Somebody reconciling their own work is reading their own homework, and they will find the differences they already expected to find.

The third pair is holding an asset and recording it. The person with the keys to the cash, the stock, the securities or the stamped forms must not also be the person who writes down how much is there. Custody against record is the oldest version of the rule and the easiest to feel. If the keys and the ledger are in one pair of hands, the ledger says whatever the holder needs it to say, and there is no arithmetic anywhere in the institution that can contradict it. CustodyHolding an asset, which is incompatible with recording what is held. and record keeping have to be two jobs so that the count can be checked against the book by somebody who does neither.

The fourth pair is changing a system and operating it. Somebody writes the change; somebody else releases it into the place where the real money moves. Change against operate is the modern version, and institutions get it wrong most often. The person who understands the change best is also the fastest person to put it in. Speed is the argument for merging them, and speed is exactly what makes the merge dangerous: a change nobody else looked at reaches live in an afternoon.

Now put the four beside each other. Initiate and approve is creating a request and confirming it. Execute and reconcile is creating a movement and confirming it landed correctly. Custody and record is creating a holding and confirming what it is. Change and operate is creating an alteration and confirming it is fit to run. All four pairs are the same pair. Every rule in every control list restates one sentence, so the one thing worth carrying away is that the creator may not be the confirmer.

Why does it work without anybody having to be trusted?

Here is the property that makes this control unusual, and it is worth stating on its own line before anything else. Most controls are behavioural: they work when a person does something correctly and stop working when the person does not. Segregation of duties is structural: it works because of how the work is arranged, and the arrangement is the same on a good day and a terrible one.

The arrangement buys something worth spelling out. A behavioural control degrades quietly and continuously. The experienced reviewer retires and the new one does not know what a wrong document looks like yet. The queue is long on the last day of the month. A person is going through something at home that nobody at work knows about. None of those things announces itself, and every one of them makes a careful check less careful. Because a structural control never depended on carefulness in the first place, it does not degrade for any of those reasons. The question a structural control asks is not whether somebody will do the right thing, but whether one person is able to complete the transaction alone, and that question has the same answer at nine in the morning and at nine at night.

Needing no trust is the usual description of the control, and the structural property is why. The phrase gets misread as cynicism about people, and it means the opposite. Separation is a design decision that removes the need to make a judgement about anybody. In an institution with two thousand people nobody can know who is under pressure, who is being leaned on, who is about to make an honest mistake with a decimal point. Nobody has to. The work is arranged so that a single wrong judgement, of any origin, does not reach the outside world on its own. Independent checkA review by somebody with no interest in the outcome and the standing to refuse it. is the whole of the mechanism, and the word doing the work in that phrase is independent.

One more consequence, and it is the practical one. Because the control is structural, it can be verified without watching anybody work. Nobody has to sit behind a desk and see whether the check was done properly. The question is a much simpler one: can this task be completed start to finish by one person with one set of permissions? If the answer is yes, the control is absent whatever the procedure says. If the answer is no, the control is present, and the separate question of whether it operates well is what the rest of this guide is about.

What does this control actually cost to run?

Presenting a control this old and this effective as free would be dishonest. It is not. Its cost is exactly what it sounds like: two people where one would do, on every instance, for ever. If a task takes four minutes and happens six hundred times a month, adding a two minute second check adds twenty hours of somebody's month. Multiply that across the tasks in an operations function and it is a real number that a real person has to find in a real budget.

There are three other costs, and they are less obvious than the salary one. The first is time in the day: a payment that needs two people can only go out when the second person is at their desk. The four o clock queue in so many places is that cost arriving. The second is the cost of the second person having enough knowledge to be worth asking. A checker who cannot tell a good document from a bad one adds a signature and no judgement. The third is the temptation the first two create. When separation is expensive, the pressure to merge the roles arrives as a sensible-sounding efficiency, and it usually arrives in a month when somebody is short-staffed.

So the question is never whether separation costs something, it is whether the thing being separated is worth two people, and an institution answers that by looking at what one person acting alone could do. A task where a single person can move money to an outside party is worth two people, almost regardless of frequency. A task where the worst outcome is an internal report with a wrong subtotal is probably not. Consequence is what that judgement turns on, and the judgement is made once and written down, rather than made afresh by whoever is on duty.

What happens when the separation genuinely cannot be made?

Sometimes there is no second person. A branch with three staff, one of whom is on leave. A treasury back office of two, one of whom is the person who raises the deals. A system so specialised that exactly one person in the building understands it. An emergency at two in the morning when the second name on the list is unreachable. None of those situations is an excuse; each is an ordinary fact of running an institution, and any account of this control that pretends otherwise is not describing a real place.

The response to that has a name. A compensating controlSomething else done to meet the objective where the separation itself cannot be made. is something else, done deliberately, that meets the same objective by a different route. The important word is objective. The objective of separating custody from record keeping is that somebody who did not handle the asset confirms what is there. The two-person form is one way of meeting it. The two-person form is not the only way, and where it cannot be used, the institution has to say which other way it is using.

Three routes come up again and again. The first is a review from outside the unit: somebody from another branch, another team or the centre does the confirming, unannounced. The second is an authority limit low enough that anything of consequence needs a second person anyway, so the merged role survives only for small items and the objective is met for everything above the line. The third is a complete after-the-fact check: nobody stops the transaction on the day, but every item above a stated size is examined afterwards by an independent person, with the record of what they found kept.

A compensating control differs from an excuse in three ways: it names the route, produces evidence that the route happened, and is reviewed by somebody who could not have authorised the departure in the first place. A line in a register saying that separation is not possible at this branch size, with nothing after it, is not a compensating control. A gap that has been written down is better than a gap nobody knows about, and it is still not in any sense a control.

Four situations that come up in any institution, with a route that meets the same objective by another means. The routes are illustrative and every institution writes its own.

What can this control never reach on its own?

Two things defeat separation, and it matters enormously that neither of them is a failure of the control. Both are situations the control was never able to address, and knowing which is which is the difference between fixing something and adding another rule that does nothing.

The first is collusionTwo or more people acting together, which defeats separation by construction rather than by failure.. If the person who creates and the person who confirms are working together, the arrangement is exactly as designed and produces exactly the wrong answer. There are two people. Both did their step. Neither skipped anything. The second pair of eyes belongs to the scheme, so the second judgement is not a second judgement at all, and separation has been defeated by construction rather than by anybody failing at it. The partner does not have to be a colleague. In the worked case here the second party was outside the institution altogether.

The second is management overrideSomebody with enough authority setting the rule aside, which the control cannot prevent and a record can expose.. Somebody with enough standing says to release it anyway, and it is released. Once again nothing has gone wrong with the separation. The rule simply was not binding on that person. No amount of further separating makes it binding: whoever is added to the chain is junior to the person setting the rule aside. Override is uncomfortable because addressing it means telling senior people that a rule applies to them. Discomfort is why the point is so often left as an unwritten understanding.

The answer to both is not more separation, and an institution that responds to either by adding a third signature has misdiagnosed what happened. Collusion is addressed by making the second check genuinely rather than nominally independent: the checker reports somewhere else, is rotated, has no share in the outcome, and is able to refuse without it costing them anything. Override is addressed by making the departure visible: every one recorded with its reason, read afterwards by somebody who could not have authorised it, and the small repeated ones counted rather than waved through. A pattern of small departures is the shape a large one grows out of.

What does it look like when the separation is missing?

Everything above is design. Vindhya Commercial Bank Limited recorded thirteen operational loss incidents over its twelve numbered months. The largest of them by net cost is incident I13, discovered in month 8, and the whole of it grew inside a gap in this one control.

A trade finance officer and a party outside the bank issued 9 letters of credit against forged shipping documents over a span of fourteen months ending in month 8. A letter of credit and how it pays belong to the trade finance material; on this desk it was simply the instrument that was issued. The bank stopped losing money when a beneficiary bank presented a claim and somebody went looking. Gross loss Rs 22.4 crore, recovered Rs 7.0 crore, net loss Rs 15.4 crore. Incident I13 alone is 1 of the 13 recorded, being 7.7 per cent of the count, and Rs 15.4 crore of the Rs 43.8 crore of net loss for the year, being 35.2 per cent of the value.

The opening was exactly one thing: the same person could both check the shipping documents and release the instrument. Read those two acts against the first pair on the list above and the shape is immediate. Checking the documents is confirming. Releasing the instrument is acting on the confirmation. When one pair of hands holds both, the confirmation is being given by the person whose own work is being confirmed, and it therefore carries no information at all. It is not a weaker check. It is not a check. The same judgement was applied twice, so whatever the first pass was willing to accept, the second pass accepted by construction.

The absence matters more than it sounds. A forgery needs one thing in order to work. A forged shipping document has to survive one specific moment: somebody looking at it who is not the person who wants it to pass. Remove that moment and the document does not have to be a good forgery. It has to be a document. The maker and checkerThe two roles a segregated task splits into, where the checker must be able to refuse. arrangement exists precisely so that the document meets a pair of eyes with no interest in it going through, and on this desk, in this bank, that pair of eyes did not exist.

The span itself says something. Fourteen months. The gap was not one bad afternoon. The arrangement was stable enough that 9 separate instruments went out over more than a year, and nothing inside the process itself objected on any of those occasions. The bank did not find it. A beneficiary bank found it, from the outside, at the point where the money was actually asked for. An institution that has to be told by a counterparty is an institution that had no internal moment where the thing could be caught, and that absent moment is what this control exists to create.

How much difference does an independent second pair of eyes actually make?

One question makes this control feel worth its cost, and the question is about repetition rather than about any single occasion. Incident I13 was not one document set. It was 9 of them, presented one after another over fourteen months. A scheme built that way has a property its designer would rather it did not have: it must survive every single occasion. Getting through eight times and being stopped on the ninth is not a partial success. It is discovery.

So set up the arithmetic, and be clear at the outset that this is the reader's own dial and not a measurement anybody at this bank ever made. Suppose a share k of trade finance document sets goes to a second, independent person before release, chosen without the officer knowing which. Suppose an independent look at a forged set catches it. Then a single set slips past unchecked with probability one less k, and all 9 sets slip past with that probability raised to the ninth power. The model has nothing else in it. A model whose assumptions are hidden is a model that flatters itself, so both of the two assumptions inside this one are printed beside the control below.

The striking thing is not the arithmetic, it is the shape: the chance of the whole scheme surviving falls far faster than the share of the work rises. At one document set in ten, a very light touch by any measure, the chance that all 9 got through is 38.7 per cent. At one in four it is 7.5 per cent. Somewhere around 28.3 per cent of sets, the chance of the whole thing surviving falls below 5 per cent, and by 40.1 per cent it is under 1 per cent. At one in two it is 0.2 per cent. A second person who looks at a quarter of the traffic is not providing a quarter of a control.

Seven solved points on one less k raised to the ninth power, for the 9 document sets in incident I13 at Vindhya Commercial Bank Limited. The result is stated as document sets reaching release and never as rupees avoided. Educational illustration.

Two cautions come before the arithmetic is used. The first is that the 9 sets are treated here as independent draws and they were not. One person produced all 9, so a checker who had seen the pattern once might well recognise it the next time. Recognition pushes the real chance of survival lower than the curve says. Something very close to that actually happened at this bank: in month 7, a trade finance document set carrying the same forgery pattern was refused by a checker, recorded as a routine refusal, and never linked to anything. Incident I13 surfaced one month later. The second caution is about the readout. The panel below reports document sets reaching release, and never rupees avoided.

What does it look like when the separation works?

The same twelve months at the same invented bank carry the other case, and it is the more useful of the two because almost nobody ever gets to see it. In month 2, a settlement instruction was prepared for release. The instruction was a duplicate: the same payment, for Rs 68 crore, going out a second time. A second named person looked at it before it left, saw that it was a repeat, and refused to release it. Nothing left the bank. Nobody was compensated. There was no incident to record and no money column to fill in. The stopped instruction sits in the bank's near miss register as N1 and appears nowhere else at all.

The refusal is the four eyes checkA requirement that a second named person reviews and releases what a first person has prepared. doing exactly the job it was designed for, and it is worth saying plainly that the person who refused did the job correctly. A careless institution is not what the near miss shows. The near miss shows a control with an unmeasured failure rate, and the rate is known to be neither zero nor one because the very same bank has the other half of the pair in the same month.

Ten days before that refusal, a settlement instruction had been sent twice and Rs 42 crore had left the bank twice. The duplicate that got out is incident I2, category 7 in the bank's loss record, gross Rs 42.0 crore, recovered Rs 41.4 crore, net Rs 0.6 crore. On the gross basis it is the largest loss of the whole year. Almost all of it came back. A duplicate payment is money sitting in somebody else's account rather than money spent, and somebody rang them up. But the cause of I2 and the cause of N1 are the same cause: an instruction that should have gone once, prepared to go twice.

So the biggest single thing this control did in the entire year is the one thing that appears in none of the bank's numbers. N1 stopped Rs 68 crore. I2 let Rs 42.0 crore go. The success was 1.6 times the size of the failure, and the success cost nothing, produced no entry, and would be invisible to anybody reading the loss record alone. A near miss register exists for exactly that reason: it is the only place where a control that worked leaves a trace of the size of what it prevented.

Who actually uses this, and not only inside a bank

The reason this control is worth treating on its own is that it is not a banking technique. Separation is the general answer to a general problem, and it turns up wherever value moves through hands, at every size.

The smallest scale is the clearest. A household running a shop keeps cash in a drawer. One person sells and takes the money; the same person writes the day's total in the book at closing. Nobody in that arrangement is dishonest, and the arrangement still cannot establish whether the drawer matches the book. The person who would notice a difference is the person who would have caused it. Moving the writing of the book to a second member of the household gives the shop, for no extra money and about four minutes a day, a fact it did not have before. The shop has separated custody from record keeping, with no policy document anywhere.

A wedding is the version everybody has seen. One person negotiates with the caterer and agrees the number of plates. A different person pays on the day against the agreed number. Households arrive at that arrangement by instinct rather than by design, usually after an occasion when one person did both and the final bill contained a surprise nobody could argue with. A residents' association is the same shape with a rule written down: the treasurer who writes the cheque is not the secretary who approves the expense, and the two are not the same person even when it would be much faster if they were.

A lender looks at exactly this before it lends to a small business, and it is often the single most informative thing about how the borrower is run. When one person in a firm raises the invoice, receives the payment, banks it and reconciles the account, the lender is not looking at a dishonest firm. The lender is looking at a firm whose books cannot be independently confirmed by anybody inside it. The lender is therefore relying on an outside auditor and on collateral rather than on the numbers themselves. The difference in how much comfort a set of accounts can carry is real, and it is visible from the seating plan.

An analyst reads the same thing from further away. A company reporting a control weakness in a revenue or a payments process is describing, almost always, a place where creating and confirming sat too close together, and the analyst's question is whether the remedy named is a real second pair of hands or a promise to be more careful. An investor in a small unlisted business can ask one question that carries a surprising amount: who can move money out of this business alone, and how many people is that. If the answer is one, everything else about the business is being asserted by a single person with nobody able to contradict them.

Separation describes what an institution can know about itself, and its absence describes what an institution cannot know.