Join the waitlist
Glossary/Risk and controls

Segregation of duties

Segregation of duties splits authorizing, recording and custody of assets among different people so that no one person can commit and hide an error or fraud.

CORAA TeamUpdated November 5, 2026

Definition

Segregation of duties (SoD) is a control activity that assigns the functions of authorizing transactions, recording them, reconciling them and having custody of the related assets to different people. The aim is that one person cannot both carry out and conceal an error or irregularity in the normal course of work.

Why it matters in an audit or review

SoD is a core part of the auditor's walkthrough in cash, purchasing, payroll and revenue. Conflicts in systems, such as a user who can create vendors and approve payments, matter as much as conflicts in job titles. Where SoD is not practical, such as in small entities, the auditor looks for compensating controls such as owner review and adjusts the approach if there are none.

Example

A five-person office has one bookkeeper who prepares checks, signs them, and reconciles the bank account. The auditor documents the conflict, asks the owner to review the bank statements and the check images monthly, and tests whether that review happened for three months. If it did not happen, the team treats the gap as a deficiency and expands testing of disbursements.

Common mistakes

Checking SoD against job titles only. System permissions often give one person more access than the org chart suggests.

FAQ

Is lack of segregation of duties always a material weakness?

No. It depends on the size of the entity, what compensating controls exist, and the magnitude of possible misstatement. In a very small entity it is more often a deficiency or a significant deficiency, depending on compensating controls.

Sources

  • AICPA, AU-C Section 315 (control activities; as amended by SAS No. 145)
  • AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
  • AICPA, AU-C Section 240, Consideration of Fraud in a Financial Statement Audit

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 315

Related terms

  • Control activities
    Control activities are policies and procedures that help ensure management's directives are carried out, such as authorizations, reconciliations, reviews, and segregation of duties, whether manual or automated.
  • Compensating control
    A compensating control limits the risk created by a missing or weak control by operating at a level of precision that would catch a material misstatement the primary control would have caught.
  • Management override of controls
    Management override of controls is the risk that management bypasses controls that otherwise work, by posting false entries or biasing estimates, and AU-C 240 treats it as present in every audit.
  • Material weakness
    A material weakness is a deficiency, or combination of deficiencies, in internal control where there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected on a timely basis.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required