Segregation of Duties (SoD) in Procurement

WHAT IS SEGREGATION OF DUTIES (SOD) IN PROCUREMENT? 

Segregation of duties (SoD) in procurement is a control that splits the steps of buying so no single person can request, approve, receive and pay for the same purchase. Dividing these duties across different people makes errors easier to catch and fraud harder to hide. 

WHY IT MATTERS IN PROCUREMENT?

Procurement moves money out of the business, so it attracts honest mistakes and deliberate misuse. When one person controls several steps, nobody else sees what happened. A buyer who can also add a supplier and release its payment can create a fake vendor and pay it. 

SoD is a core internal control principle that auditors test. Weak separation is a common finding because it builds up quietly as people change roles and system access accumulates. Fixing it after an incident costs far more than designing it in. 

THE CORE PROCESS / LIFECYCLE 

• Duty Mapping. Procurement and finance list every step in the purchase-to-pay flow, from supplier setup and requisitioning through approval, receipt, invoice entry and payment. Each step is tagged as a duty that needs an owner. 
• Conflict Rules. The team defines which duty pairs cannot sit with one person. A common rule is that whoever creates a purchase cannot approve it, and whoever maintains suppliers cannot release payments. 
• Role Design. Roles are built around the rules, then assigned by job. System permissions follow the roles, so conflicts are blocked at the point of access, not discovered later. 
• Compensating Controls. Small teams cannot always separate every duty. Where they cannot, a second reviewer, tighter approval limits or after-the-fact transaction review covers the gap. 
• Monitoring. Reports flag users holding conflicting access and transactions where one user touched incompatible steps. Exceptions are investigated and logged. 
• Periodic Review. Access is recertified on a schedule and whenever someone changes role, because conflicts usually appear after moves, not at hiring. 

CORE COMPONENTS 

Duty definitions state what each step in the purchase flow involves. A conflict matrix lists the duty pairs that must stay apart. Role-based access turns the matrix into system permissions. Approval limits cap what each role can approve. Exception handling records any override, who approved it and why. 

KEY BENEFITS 

SoD reduces fraud opportunity, because a scheme now needs a second person to cooperate. It catches honest errors earlier, since another person sees each step. It supports clean audit results and cuts findings tied to access. It protects employees, because clear separation shows nobody had unchecked control. And it makes access reviews faster, since roles are designed around rules, not built one user at a time. 

COMMON PITFALLS 

• Writing rules but ignoring system access. A policy on paper means little if one login can still do both steps. 
• Letting access pile up. People who change roles keep old permissions and quietly collect conflicts. 
• Granting emergency access with no follow-up. Temporary override rights that are never reviewed or removed become permanent gaps. 
• Applying one rule to every company size. A small team may need compensating controls where full separation is not practical. 

DUTY PAIRS THAT SHOULD NOT SIT WITH ONE PERSON 

These are common conflict pairs. Each organization sets its own list based on risk. 

• Request and approve. The person who raises a purchase should not approve it, or spending is signed off by the one who wanted it. 
• Approve and receive. Whoever approves a purchase should not confirm delivery, or a fictitious receipt can be created to match an approved order. 
• Receive and pay. The person who records receipt should not release payment, which keeps proof of delivery apart from the money. 
• Maintain suppliers and pay. Changing supplier bank details and releasing payments together is the classic route to a fake-vendor payment. 
• Maintain suppliers and approve. Creating a supplier and approving spend with it removes the check on whether the supplier is real. 

KPIs

KEY TERMS 

• Conflict Matrix. A grid showing which duty pairs cannot be held by the same person. 
• Role-Based Access. Granting system permissions by job role, not person by person. 
• Maker-Checker. A control where one person creates a transaction and a different person approves it. 
• Compensating Control. An alternative safeguard used when full separation of duties is not practical. 
• Access Recertification. A scheduled review in which managers confirm each user’s access is still appropriate. 
• Vendor Master. The record of approved suppliers and their bank details. 
• Three-Way Match. A check across the PO, goods receipt and invoice, which relies on those steps being done by different people. 

FAQs

1. What is segregation of duties (SoD) in procurement?

Segregation of duties (SoD) in procurement is an internal control that separates purchasing responsibilities among different employees to prevent fraud, errors, and unauthorized transactions. Key activities such as purchase requisition, approval, goods receipt, supplier management, and payment authorization are assigned to different individuals. This separation ensures no single employee has unchecked control over the entire purchasing process, strengthening financial accountability and procurement compliance.

2. Why is segregation of duties important in procurement?

Segregation of duties is important because it reduces procurement fraud, unauthorized spending, and financial reporting errors. Separating purchasing responsibilities prevents individuals from independently creating suppliers, approving purchases, and releasing payments. It also strengthens internal controls, supports audit compliance, and improves transaction transparency. Effective SoD policies help organizations identify suspicious activities earlier and maintain accountability throughout the procure-to-pay (P2P) process.

3. Which procurement duties should be segregated to prevent fraud?

Procurement duties that should be separated include purchase requisition and approval, purchase approval and goods receipt, goods receipt and payment authorization, and supplier master data maintenance and payment processing. For example, an employee who creates or modifies supplier banking details should not independently authorize payments to that supplier. These controls reduce opportunities for fictitious purchases, duplicate payments, unauthorized supplier changes, and financial misconduct.

4. What is an SoD conflict matrix in procurement, and how does it work?

An SoD conflict matrix is a control framework that identifies purchasing activities that should not be performed by the same employee. It maps responsibilities such as supplier creation, purchase approval, goods receipt, and payment authorization to detect conflicting access rights. Procurement and finance teams use the matrix to design user roles, establish approval restrictions, and identify potential fraud risks. Regular updates help maintain effective access controls as employee responsibilities change.

5. How can procurement software enforce segregation of duties?

Procurement software can enforce segregation of duties through role-based access controls, automated approval workflows, and permission restrictions. Organizations can configure systems to prevent employees from approving their own purchase requests or combining supplier maintenance with payment authorization. Automated monitoring can identify conflicting permissions, unusual transactions, and policy exceptions. These controls improve purchasing transparency, support audit readiness, and reduce reliance on manual compliance checks.

6. How can small businesses implement segregation of duties with limited staff?

Small businesses can implement segregation of duties using compensating controls when staffing limitations prevent complete separation of responsibilities. Practical measures include independent transaction reviews, dual approvals for high-value purchases, restricted payment permissions, and periodic supplier master data audits. Management should document exceptions and review transactions involving conflicting duties. These safeguards help smaller procurement teams reduce fraud risks without requiring additional employees for every purchasing activity.

7. How often should segregation of duties controls be reviewed?

Segregation of duties controls should be reviewed at least annually and whenever employees change roles, responsibilities, or system permissions. Organizations should also reassess access after temporary overrides and significant process changes. Regular SoD audits help identify conflicting permissions, excessive access rights, and unresolved compliance exceptions. Procurement and finance teams can measure effectiveness through access recertification rates, open SoD violations, and the time required to resolve identified conflicts.