Cedar Valley Bank: Segregation of Duties in a Fourteen-Person Finance Team

First, the AP clerk can create a vendor, enter an invoice, and release payment, which allows a fictitious vendor and payment to be created and hidden without another person touching the transaction. Second, the supervisor as backup and approver means the monthly exception review is not independent; the same person can both create and clear an exception. Third, a manager approving a subordinate's wire is not true dual control if the manager can be influenced, is the beneficiary, or lacks the technical ability to challenge the initiator. Fourth, IT administration plus AP inquiry allows vendor bank-detail changes without independent verification, enabling payment redirection. Fifth, monthly reconciliation after payment can detect some errors, but it does not prevent them and may be performed by someone inside the same process. The risk is not only theft; it is also concealment through the same access that creates the transaction. Each incompatible combination should be mapped to a specific fraud scheme: fictitious vendor, duplicate payment, wire redirection, and unauthorized payment release.

Evaluate compensating controls by asking who reviews, what evidence they see, whether they can override, and whether exceptions are followed up. The current exception report fails those tests because the reviewer is the clerk's backup and has approved payments, so independence is compromised. The review is also after the fact; it does not prevent a payment from leaving the bank. Monthly reconciliation may catch a difference, but if the same finance team controls both the payment and reconciliation records, it can be defeated. Wire dual approval is nominal if the second approver is the initiator's manager and no independent call-back occurs. The external auditor's clean result is not persuasive because the audit focused on reconciliation performance, not on access conflicts. Recommend testing a sample of vendor master changes, payments released by the AP clerk, and wires approved by the manager to see whether documentary evidence of independent review exists. Without that evidence, the conflicts remain unmitigated.

Start with system-enforced role separation where the ERP already supports it: remove payment release from the AP clerk, restrict vendor creation to a master-data role, and separate IT administration from AP inquiry. Require dual approval for vendor bank-detail changes, with one approver outside AP, and add an independent call-back to a known vendor number before the first payment after a change. Use the controller's two hours for a weekly review of a targeted report: new vendors, bank-detail changes, manual payments, and wires initiated and approved within the same reporting line. Rotate the AP supervisor's backup role to someone outside AP, or eliminate the backup by cross-training a finance analyst who does not release payments. Perform daily bank-account reconciliation by someone independent of payment release, and have the controller sign off monthly on access reviews. Perfect segregation may be impossible with 14 staff; document the residual risk and test the mitigating controls rather than claiming they eliminate the conflict.