In payments this usually means splitting four capabilities: creating a vendor, changing bank details, entering a payment, and releasing it. Small finance teams often collapse these into one or two people, which is the condition most commonly cited in post loss reviews.
Dual control only works if the second approver is looking at something meaningful. Approving a payment batch without visibility into what changed since the last run is a signature, not a control.
The quiet failure is access that outlives the split. Someone keeps a banking token from a previous role, a shared login sits in a password manager, or an administrator can grant themselves an approval right and then use it. On paper the duties are separated; in the entitlement report they are not. Reviewing who can do what, at the system level, is the only way to see that.
Segregation of duties also has to survive the exceptions: month end, an absent approver, an acquisition, a vendor threatening to halt delivery. Write the break glass path down in advance, require a named second person for it, and log every use. An undocumented exception path is where the control is actually spent.
Common questions
Split the highest risk pair first, changing bank details and releasing payments, and use the bank's own approval tiers to enforce a second approver even when only two people are available.
Dual approval is one implementation of it. Segregation of duties also covers who can create records and who can execute, not only who signs off.
Changing a vendor's bank details and releasing payments to that vendor. When one person holds both, a single deception completes the whole fraud.
Define the exception path in advance with a named alternate approver, require the same verification evidence, and log each use so exceptions can be reviewed rather than repeated quietly.
On a fixed schedule and again after every role change, because separated duties on paper are frequently rejoined by leftover access in the banking portal or the accounting system.
Sources and further reading
Citing this entry? Cite as Coffr, LLC and link to https://getcoffr.com/glossary/segregation-of-duties.