Doing this with few people.
WHAT THE CONSTRAINT IS
Separation of duties requires people you do not have.
WHAT NOT TO CONCLUDE
That controls are therefore impossible.
WHAT THE OWNER CAN DO PERSONALLY
Receive and examine bank statements directly Approve payments above a threshold Review the supplier list Sign cheques or authorise transfers Count cash and stock at intervals Review the payroll listing
WHY THOSE SPECIFICALLY
They require little time and they address the largest exposures.
WHAT TO ESTABLISH
That bank statements come to you, unopened by anyone else.
WHY
It is the most effective single control available.
WHAT TO ROTATE
Duties, where possible.
WHY
It exposes what one person was doing.
WHAT MANDATORY LEAVE ACHIEVES
Someone else performs the role, and ongoing concealment breaks down.
WHAT TO ESTABLISH
That everyone takes leave, with cover.
WHAT TO USE
Technology that provides separation: system approvals, restricted access, logged actions.
WHY
It substitutes for people.
WHAT TO AVOID
Relying entirely on trust in one person.
WHY IT DESERVES SAYING DIRECTLY
The people who commit fraud are the trusted long-serving ones, because they have access.
WHAT TO RECOGNISE
That controls protect honest staff as well.
WHY
Without them, suspicion falls on everyone when something goes wrong.
WHAT TO EXPLAIN
That controls are not personal.
WHAT TO ESTABLISH AS YOU GROW
Proper separation, as soon as the people exist.
