Approvals and segregation of duties: protecting your business from error before fraud

Many small business owners assume internal control is a matter for large companies and their auditors. In fact, most of what approvals prevent is not fraud but ordinary error: an amount typed with an extra zero, an invoice recorded twice, a payment posted to the wrong account. A second person’s look before a document enters the books catches most of these in seconds, and costs far less than correcting them after closing.

Principle one: the creator does not approve

Segregation of duties means no single person owns a whole process: whoever creates a payment voucher does not approve it, and whoever approves it does not hand over the cash. A small business may not have enough staff for full separation, but separating creation from approval is almost always possible, even if the approver is the owner. And if someone does need to approve what they create, make it an explicit decision on their permissions that is known and reviewed — not a gap nobody knows about.

Principle two: the approval level follows the amount

Not every document needs the managing director’s approval. A small payment for a recurring expense needs one approver; a large purchase contract needs two or more. Define bands by amount, set the number and identity of approvers for each band, and give every user a financial limit above which they cannot approve. Approval then stays fast for the routine and careful where the risk is.

Principle three: delegation with an end date

A manager travels or takes leave and gives a colleague their permissions “temporarily” — and the permission stays for a year. Proper delegation is a mandatory time window that ends by itself, covers specific permissions rather than a person and everything they hold, and never extends the financial limit without an explicit decision.

Principle four: approved means locked, and the trail is kept

• An unapproved document does not enter the general ledger or the financial statements.
• An approved document is not edited; it is first unapproved with a written reason, and that leaves a trace.
• A rejected document is void and is not edited back to life; you duplicate it into a new one if needed.
• A document that needs correcting goes back to its creator with a note, and returns for approval once corrected.
• Every change records who made it, when, and what it was before and after.

Principle five: permissions are enforced in one place

Hiding the approve button on one screen is not enough if another screen, or a direct request, can still reach the data. Real protection means permissions are checked at a central point and on the server, so no new screen depends on someone remembering to protect it.

Principle six: who reviews the reviewer?

Approval protects against the creator’s mistakes, but not against an approver who signs without reading. So control needs a light third layer: a periodic after-the-fact review of a sample of approved documents by someone who took part in neither creating nor approving them — the external accountant, a partner or the owner. An automatic report that gathers what deserves a look, such as duplicate documents and accounts running against their normal balance, helps here, so the review does not start from scratch every time.

Signs that your controls have a gap

• Many documents approved within the same minute they were created.
• One approver approving everything because nobody else has the permission or the time.
• Frequent edits to approved documents after they have been unapproved.
• Amounts that keep landing just below an approval limit, as if split to stay under it.
• Differences that appear at closing with nobody knowing where they came from.

How to start in a small business

• Start with payment vouchers and transfers, because they are what moves money out of the business.
• Make the owner or a partner the approver above an amount you set, and leave anything below it to the finance manager.
• Add purchase invoices and manual journals after a month, once the team is used to the cycle.
• Review every quarter: who approved what, and whether the bands need adjusting.

And do not let approval become pointless friction: documents that do not issue journal entries, such as internal requests and tasks, do not need a financial approval cycle, and too many steps on small documents push the team to work around them. The aim is to put the second pair of eyes where the money and the risk are, not everywhere.

A quick checklist for your business

• Can anyone today create a payment voucher and approve it themselves? Do you know who?
• Does every user have a written financial limit?
• Is there an old delegation that never ended?
• Are your reports built from approved documents only?
• Can you tell who changed a specific document, and when?

How Arttop 360 handles it

Each financial document type has its own approval setting: one approver or several, or bands by amount with their own approvers, with the option to prevent creators from approving their own records. A user approving what they created is a permission added explicitly to their card, and each card carries a financial limit that the server enforces as well. Delegation sits on the permissions card with a window of no more than ninety days, includes the financial limit only through an explicit checkbox, and cannot be used to delegate the system administrator.

A pending document stays outside the general ledger, reports come from approved documents only, an approved document is locked and the only way out is an unapproval with a reason, and a rejected document is void — duplicated, not edited. All documents that issue journal entries come together in the «Approvals Hub», where each approver sees what is waiting for them, and permissions are enforced centrally and on the server rather than screen by screen.

Related pages

• Security and data protection
• Accounting and finance