How do we have segregation of duties when finance is two people?

An investor's due-diligence list asks who approves payments and where the approval limits sit. Your honest answer is that your finance manager raises the payment and the managing director clicks approve on their phone, usually without opening the invoice.

The textbook answer is to separate duties across four people. You have two. That does not mean the control is unavailable to you. It means you choose which separation you buy first.

The four duties, and the one split that matters

• Authorisation — deciding the spend should happen.
• Custody — holding the asset, in practice access to the bank.
• Recording — entering it in the accounting system.
• Reconciliation — checking the record against the bank.

With two people you cannot separate all four. The split that prevents the most loss, and the one every reviewer looks for first, is between creating or amending a payee and releasing money to that payee. Nearly every supplier-payment fraud in a small company runs through a changed bank account, not a fake invoice.

Compensating controls a reviewer will accept

When you cannot separate a duty, you detect instead. State the limitation plainly and name what you do about it. That combination is what gets accepted.

1. 01Owner review of the bank statement, monthly, by someone outside finance — usually the managing director or a director. Signed and dated, even if it is a two-minute scan.
2. 02A new payee and amended bank details report, run monthly and reviewed by that same person.
3. 03Dual release in the bank for anything above your approval limit, with the second releaser outside finance.
4. 04A payment run that goes out on fixed days, so anything urgent and out of cycle is visible by definition.
5. 05Someone other than the preparer performs the bank reconciliation, or the reconciliation is reviewed and signed if the same person must prepare it.

Approval limits: pick numbers and write them down

Most SMEs have limits in someone's head. Writing them into a one-page delegation of authority is often the single cheapest governance improvement available, and it is the artefact investors ask for by name.

• State a value band for each approver, including the board, and say what happens above the top band.
• Cover the transaction types that behave differently: recurring supplier payments, one-off payments to new payees, staff expenses, payroll changes, credit notes and customer write-offs.
• Name who approves when the usual approver is unavailable, because an undocumented deputy is where limits quietly stop working.
• Date the document and review it annually. An undated policy reads as an unused one.

How to describe it in due diligence

Do not claim full segregation. Write the limitation, the compensating control and the review evidence in three sentences. A reviewer reading that concludes you understand your own risk, which is the judgement they are actually forming about your management team.