Fraud usually needs two keys. Segregation of duties makes sure one person never holds both.
No single person should be able to create a supplier, enter an invoice and release the payment. Split four duties: supplier master changes, invoice entry, invoice approval and payment release, and add an independent reconciliation. In small teams that can't fully separate duties, use compensating controls such as dual release, an independent review of change reports and periodic spot checks.
| If one person can | They could |
|---|---|
| Change supplier details and release payments | Redirect a genuine supplier's payments to their own account |
| Create suppliers and enter invoices | Invent a supplier and invoice it |
| Enter and approve invoices | Approve their own fictitious or duplicated invoices |
| Release payments and reconcile the bank | Hide an unauthorised payment |
| Duty | AP clerk | AP supervisor | Finance manager |
|---|---|---|---|
| Supplier master changes | No | Keys changes | Approves changes |
| Invoice entry | Yes | No | No |
| Invoice approval | No | No | Budget holders approve |
| Payment release | No | Prepares run | Releases |
| Bank reconciliation | No | No | Reviews; prepared by someone outside AP |
The exact roles will differ in your team. What matters is that no row conflict from the risk table sits with one person.
With two or three people, full separation isn't always possible. Compensate with:
A policy that says the AP clerk can't release payments is no use if their system login can. Once a quarter, export who actually has which permissions in your ERP and banking platform, and compare it with the matrix. Access tends to accumulate as people cover for each other.
Before each run, use the payment run approval checklist.
US: public companies document segregation of duties as part of their Sarbanes-Oxley internal control testing, and auditors test it.
UK: most private companies have no equivalent statutory regime, but auditors still assess it, and the same risks apply.
Score a payment request against the warning signs of fraud. Free to use online.
The Accounts Payable Control System runs four duplicate-invoice tests, supplier master fraud checks and a three-way match on every invoice, with a payment run release gate that blocks release while exceptions are open. Excel, no macros, one-time price.
They can do the processing, but someone else should release payments and review supplier changes and bank statements. Dual release in the bank is the simplest safeguard.
Only if it's traceable to the invoice and the approver is the right person. Emails can be forged or forwarded, so system-based approval with a log is stronger.
A check that reduces the risk when duties can't be separated, such as an independent review of changes or a second person releasing payments.
Export user roles and permissions from your ERP and banking platform, list who can change suppliers, enter invoices, approve and release payments, and compare that list with your duties matrix. Remove any access that breaks it.
Last updated 18 October 2026. General guidance for finance teams; check it against your own policies, systems and local rules.