Who approves a supplier payment, and who makes it

What separation of duties is

The rule itself is one sentence: whoever approves a cost is not whoever moves the money. Two different people, two different actions, and a record showing who did which.

The idea comes from audit, and there it sounds like bureaucracy. In a small business it sounds entirely different, because it is not protecting the company from its staff. It is protecting the business from a mistake nobody would catch, and protecting the person from being the only one who can explain what happened.

Why this is not only for large organisations

In a large organisation separation of duties prevents fraud. In a small business it mostly prevents duller things that are far more common: a double payment, a payment for goods that never arrived, a price that went up unnoticed, a credit note promised and forgotten.

None of those has a villain in it. Each has a busy person who saw one document rather than three, approved, and paid. When one person does both actions, there is no moment at which somebody else looks.

Three roles, and what each one cannot do

The division below is the one InPlace is built on, and it is an example of a division that works. What matters in it is not the names but the second column: what each role cannot do.

Note that none of the three is limited because they have no need. They are limited because the need of one is exactly what would make the other one’s check worthless.

What happens in a business without it

Nothing happens, for a long time. That is the misleading part. A business can run for years with one person doing everything, and most of the orders genuinely are fine.

The loss is not one large event but an accumulation: a price that changed, a product that did not arrive, a credit note forgotten, an invoice never checked to the end. Each is too small to justify a check, and together they are the amount nobody saw.

The sign that it is happening is not a deficit. It is the question “why did we pay this supplier so much this month”, asked at the end of the month with no answer that does not involve opening a mail folder.

Where most businesses break

Not at the definition. At the exception to it.

Almost every system that defines permissions also allows them to be stepped around: an administrator right, an emergency route, or simply a bank transfer made outside the system because the supplier called and it was urgent. The moment that route exists, it opens in exactly the cases where the check was worth the most.

A separation of duties that can be switched off under end-of-day pressure is not a separation of duties. It is a statement of intent.

How to start when one person does everything

Nobody needs to be hired. The minimum separation already worth something is between whoever orders and whoever moves the money, and in most small businesses those two are already done by two different people in practice, just without it being written anywhere.

• Decide who approves. One person, in writing, even if it is the owner
• Decide that no transfer goes out without that approval, and that the approval is kept with the document rather than in a conversation
• Add the check: a comparison of the order, the goods received and the invoice before the approval is given

The third step is what turns the first two from discipline into a process. An approval without a check is a signature on a document nobody read.

And what about a one-person business

There you cannot separate people, but you can separate moments. The check happens when the invoice arrives, and the approval is given at a set time rather than in the same breath. It sounds small, and it is the difference between looking at a document and comparing it against two others.

What stays the same is the record. Even when the approver and the payer are one person, the answer to “who approved this, and why” has to be kept somewhere other than their memory.