Blog · Controls and audit
Segregation of duties in purchasing
Segregation of duties means no one person controls a purchase from start to finish. Split every purchase into four duties (request, approve, receive and pay) and make sure nobody holds two of them for the same purchase. It stops fraud, but mostly it catches honest mistakes, and a business of five people can do it with a few plain rules.
The four duties
Every purchase passes through the same four steps, whether you write them down or not. Someone asks for it, someone agrees to spend the money, someone confirms it arrived, and someone pays the supplier.
Each duty is a check on the one before. The approver checks the request makes sense. The person receiving checks that what was agreed actually turned up. The person paying checks that the invoice matches what was ordered and received. When one person holds two of those duties, one check quietly disappears.
- Request: describe what is needed, from which supplier, at what price, with the quote attached.
- Approve: decide the purchase is needed and affordable, within a limit the business has set.
- Receive: confirm the goods or service arrived in the quantity and condition ordered.
- Pay: release the money against an invoice that matches the order and the delivery.
What goes wrong when duties are combined
The classic fraud needs only two duties in one pair of hands. A person who can add a supplier and pay it can invent a supplier and pay themselves. A person who can request and approve can buy things for their own use. A person who receives and pays can pay for a delivery that never came, and nobody else ever looks.
The honest mistake is the more everyday risk, and it costs real money too. Someone approves their own urgent order without noticing the price has gone up since the last quote. The person who took the delivery is also the person paying, so a short delivery is paid in full because they were sure it all arrived. An invoice is paid twice because the same person keyed it in both times. A second pair of eyes catches these things because it hasn’t already decided what it expects to see.
Separation also protects the people involved. When a question comes up months later, the person who raised a request can point to someone else’s approval, and nobody has to defend a decision they made alone.
Separating duties in a small team
Large finance teams separate duties by department. A business of five can’t, and doesn’t need to. The aim is that no single person holds two duties for the same purchase, not that every duty has its own job title.
- The owner approves, someone else pays. If the owner or a director signs off spending, a bookkeeper or office manager prepares the payments, and the owner releases them only after checking they match approved orders.
- Nobody approves their own request. When the owner raises a request, it goes to a fellow director or a named second person. If there is no one, record the reason and have it reviewed after the event.
- Whoever receives isn’t whoever pays. The person on site signs the delivery note. Whoever pays checks the invoice against that signed note, not against memory.
- Supplier changes need a second person. A new supplier or new bank details are confirmed by someone other than the person who pays, by calling a number you already hold.
- Cover is arranged before someone goes away. Name who approves in their place, with the same limit, and make sure the cover is never the person who raised the request.
Who holds each duty, and what to check
The roles below are typical for a small or mid-sized business. Your names will differ; what matters is that the same name doesn’t appear twice against one purchase.
| Duty | Who typically holds it | What to check |
|---|---|---|
| Request | The person who needs the item, or a team lead | The quote is attached, the supplier is known, and the price and quantity are clear. |
| Approve | A manager, director or owner with a set limit | The total is within their limit, and they are not the person who raised it. |
| Receive | Whoever is on site: stores, reception or the site lead | What arrived matches the order; short or damaged deliveries are noted on the delivery note. |
| Pay | A bookkeeper or finance person, with a second person releasing payments | The invoice matches an approved order and a confirmed delivery, and hasn’t been paid before. |
| Change supplier details | Someone other than the person who pays | New bank details are confirmed by phone, on a number you already hold. |
What auditors and funders look for
An auditor reviewing your purchasing usually wants to see three things. First, that approval happened before the money was committed, not after the invoice arrived. Second, that the person who approved was not the person who asked, and had the authority to approve that amount. Third, that the record can’t be quietly changed afterwards.
Banks, investors and grant funders ask similar questions, often in a due diligence checklist. They want to know who can commit the business to spending, how that is limited, and what happens when the usual approver is away. A written policy helps, but evidence that it is followed matters more: a sample of orders with a different name on the request and the approval, and a log of changes.
If you can’t separate a duty, say so and show the compensating check. A monthly review of every payment by the owner, or a look through new suppliers each quarter, is a reasonable answer for a small team. Your accountant can tell you what your auditor or funder will expect.
Putting it in writing
Separation of duties works well as part of a short purchasing policy that also sets approval limits. Start with approval limits and delegation of authority, then write the rules down with how to write a purchasing policy. If paying twice is your worry, read how to stop duplicate supplier payments.
Questions
What is segregation of duties in purchasing?
It means splitting a purchase into separate steps (requesting, approving, receiving and paying) so no single person controls all of them. Each person checks the step before theirs, which catches both fraud and honest mistakes.
Can a small business really separate duties?
Yes, as long as you separate them per purchase rather than per department. The owner can approve while a bookkeeper prepares payments, and nobody approves their own request. Where you can’t separate a duty, add a review after the event.
Should a manager be able to approve their own purchase request?
No. Their request should go to someone else, even if it is within their limit. If they are the owner, a fellow director or a named second person approves it instead.
What happens to approvals when the approver is on holiday?
Name a cover approver before they go, with the same limit, and never the person who raised the request. Otherwise requests either wait or get approved by whoever happens to be around.