Segregation of duties is not an accounting lecture.
It is an operational control: one person should not be able to request, approve, receive, and pay without review.
Start here:
The simplest separation that works
Separate these responsibilities:
- requester (demand)
- approver (authorization)
- receiver (evidence of receipt)
- payer (financial execution)
Why audit logs matter
Separation is only enforceable if actions are traceable.
Audit logs help teams answer:
- who approved?
- when was it approved?
- what changed after approval?
Next steps
If you want separation-of-duties controls to survive real operations: