Separation of duties in accounting, enforced instead of trusted

Separation of duties in accounting is the rule that the person who prepares a piece of work is not the person who approves it, checks it or holds the asset it describes. GAO's internal control standards put it as dividing key duties "among different people to reduce the risk of error, misuse, or fraud", so "that no one individual controls all key aspects of a transaction or event" (GAO Green Book, May 2025). In bank regulatory reporting the rule is examined directly: the OCC lists it first among the fundamental controls over the Call Report. It is hard to keep because finance teams are small, people go on leave, and system access drifts until a reviewer can also post. Botminds' Regulatory Reporting Controls exists to enforce it on each control instance rather than trust it to a policy document.

What is separation of duties in accounting?

It is the division of a process so that no single person can both make an error and hide it. GAO's 2025 standards, which adapt the COSO framework for federal agencies and are a useful public statement of the principle, describe separating "the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets" (GAO-25-107721). The same text is candid about the limit: separation "can mitigate the risk of management override" but "cannot absolutely prevent it because of the risk of collusion, where two or more employees act together".

Separation of duties and segregation of duties are the same idea under two names; examiners and auditors use both. In regulatory reporting the "transaction" is usually not a payment but a number: a reconciled balance, a journal entry, a mapping rule, a line on a schedule. The question is the same. Can one person put a wrong number on the Call Report and also be the person whose sign-off says it was checked?

Why is segregation of duties important for regulatory reports?

Because examiners expect it by name, and because a small undetected error can be material. The OCC's booklet for examiners names three "fundamental internal controls" for regulatory reporting, and separation of duties comes first, ahead of dual controls and independent reconcilements. Its example is the reconciliation this page keeps returning to: the general ledger accounts reconciled to the figures in quarterly and annual regulatory reports (OCC Comptroller's Handbook, "Regulatory Reporting," 2021). Its list of what bank procedures should cover puts separation of duties, dual controls, independent reconcilements and manual adjustments side by side.

The materiality test explains the stakes. The same booklet warns that an error that looks small against total assets can still be material, and that a small adjustment matters most when capital is thin enough for it to move the bank into a different prompt corrective action category. Republic First Bank is the public example of where that ends. The FDIC's Office of Inspector General found that it amended three quarters of Call Reports in September 2023, and that the amendments dropped the bank to adequately capitalized for prompt corrective action purposes (FDIC OIG, Material Loss Review of Republic First Bank, 2024).

Which duties are incompatible in Call Report work?

Six pairs cover most of the risk. Each pair is two duties that, held by one person, let that person create an error and also certify that it was checked. The matrix below is a starting point for any bank's own: it lists the pairs, why each conflicts, and the separation that answers it.

The fifth row is the OCC's own question turned into a rule. For banks that use software or automated mapping, its questionnaire asks whether the person who verifies the regulatory reporting data is someone other than the person who files the report (OCC internal control questionnaire, question 3). A matrix that a reviewer can answer only from the org chart is not finished. The fourth row needs the access listing from the system itself, because posting rights are granted one ticket at a time and rarely taken back.

What does the OCC say about separation of duties?

It says three things, in three places. In the risk management section, separation of duties is a fundamental control and should be used for the reconciliation of general ledger accounts to reported figures. In the procedures examiners use, they assess whether bank procedures address separation of duties, dual controls, independent reconcilements and manual adjustments, and whether the bank's internal controls are of those types and work as designed. In the personnel section, it adds periodic rotation of duties, for three stated reasons: succession, depth of knowledge, and the prevention or detection of fraud (OCC Comptroller's Handbook, Regulatory Reporting).

Rotation is the part teams forget. A reviewer who has checked the same reconciliation for six years reads it the way its preparer does. Rotation also creates the backup that the sample bank lacked in July: a second person who already knows how to review the control when the first is away.

Can the preparer review their own Call Report work?

No. A review by the preparer is not a review, whatever it finds, and the OCC expects the bank to designate an independent person or group to review regulatory reports for accuracy before filing. The difficulty is that a self-review rarely looks like a decision. It looks like the sample bank's July: a reviewer on leave, no backup set, a month-end that will not wait, and a preparer who signs the review box intending to have it re-reviewed later.

That is why a policy is not enough. The policy at the sample bank said the right thing and named Theo as the reviewer. The general ledger allowed the same user to mark the reconciliation prepared and reviewed. Nobody compared the two names on the sign-off log until a checking agent did it as the control ran, at 19:07, one minute after the review.

The system refuses a preparer who tries to review her own work

The rule is checked per instance: Dana prepared July, so she cannot review July. It does not stop her preparing August.

A segregation of duties policy says who should review. Only the sign-off log says who did.

What is a segregation of duties matrix, and how do you test one?

A segregation of duties matrix is a grid of roles against duties that marks the combinations no one person may hold. Building it is the easy half. Testing it means comparing it with three things the matrix does not contain: who actually prepared and reviewed each instance, which entitlements each person holds in each system, and who covered for whom during leave.

The second item is the one access reviews and segregation reviews tend to split between two teams. In the sample bank, Victor Almeida held posting rights in the loan subledger. He is a capable accountant and would have been the obvious stand-in reviewer for July. He was not independent of it.

Can a small bank segregate duties?

Often not completely, and the standards allow for that if something else covers the gap. GAO's standards say: "If segregation of duties is not practical within a business process because of limited personnel or other factors, management designs alternative control activities to mitigate the risk of fraud, waste, or abuse in the business process" (GAO Green Book, para. 10.23). The OCC lets a bank buy in the pre-filing quality control review from a third party instead of staffing it, provided the reviewer is trained in and familiar with the bank's reporting process.

The usual alternatives are a detective review by an officer outside accounting, a review bought in from a third party each quarter, and a full re-performance of the few controls where one person must both prepare and approve. Each of them has to leave evidence that it happened. A small bank that cannot separate a duty should be able to show, instance by instance, who checked the person who held it.

Dual control, maker-checker and separation of duties are not the same thing

They are three tools for the same risk, at different scales. Dual control needs two people present to complete one act, such as opening a vault or recounting cash; the dual control in banking guide covers what that second signature proves. Maker-checker needs a second person to verify a change before it takes effect, as in the maker checker process in banking for payment repairs. Separation of duties is the design of the whole process so that no one role holds incompatible duties across it.

Call Report controls use all three. Approval of a large manual journal entry before posting is maker-checker. A mapping change approved by a second administrator is maker-checker on configuration. Keeping the reconciliation preparer, the reviewer, the filer and the attester four different people is separation of duties. Internal control over financial reporting, as the SEC defines it, includes the policies that provide reasonable assurance that transactions are recorded "only in accordance with authorizations of management and directors" (17 CFR 240.13a-15(f)); all three tools serve that phrase.

How Regulatory Reporting Controls enforces separation of duties

The solution turns the matrix into rules the system applies, and the rules are not advisory. Six of them cover the whole attestation: a preparer never reviews the same control instance; a process owner never tests their own controls; only the Controller assigns reviewers, decides deficiencies and revokes; only the owner signs their sub-certification; internal audit stays independent; and the Controller recommends while the CFO attests. A blocked action names the rule it broke. Changing a rule needs two administrators and the CFO.

Only independent people can be picked as the re-reviewer

The checking agent, the Skeptic, does the comparison an auditor would do months later. It reads the sign-off log for every instance, compares the preparer with the reviewer, checks the reviewer's entitlements and the leave roster, and flags evidence dated after its sign-off. Each flag cites the log entry it rests on and holds the owner's sub-certification until a person decides; the Skeptic never closes its own flag. When Theo re-reviewed July, the Skeptic re-checked his independence before the Controller saw the result.

What it does not do is decide that a break was harmless. That judgment belongs to the Controller, informed by a re-performance of the instance; how a break like July's is classified, and why it was a control deficiency and not something worse, is worked through in material weakness vs significant deficiency on a Call Report control. The settings screen below shows the roles and the first three rules as the sample bank configured them.

Roles, who sees customer data, and separation-of-duties rules that cannot be switched off quietly

Questions people ask

What is the difference between separation of duties and segregation of duties?

None in substance. Both mean dividing incompatible duties among different people; the OCC's regulatory reporting booklet uses both terms on the same page. "Segregation" is more common in audit literature and "separation" in access-control and examination texts.

What is a dual control?

A control that needs two people to complete one act together, such as two keys to a vault or two people at a cash recount. The OCC lists dual controls next to separation of duties and independent reconcilements as the fundamental controls for regulatory reporting.

Is a self-review always a deficiency?

It is always a failure of the control instance, because the review the control claims did not happen. How severe it is depends on what re-performance shows and on whether another control, such as a line-by-line variance review, would have caught an error. In the sample bank the July balance tied to the cent and was classified as a control deficiency.

Does a reviewer need read-only access?

It is the cleanest answer. A reviewer who can post in the system they review can fix a problem instead of reporting it, and the fix leaves no exception behind. Where read-only access is not practical, the reviewer's own entries in that system should be reviewed by someone else.

How often should separation of duties be tested?

On every instance of a key control, if the comparison can be automated from the sign-off log, and at least each quarter before the CFO signs if it cannot. A test done once a year by internal audit finds breaks months after the reports they affected were filed.