AS | Ankit Sarawagi|Founder, CFOmatrix·July 2026·9 min read | The realistic minimum |
- Four duties should never sit with one person: initiate, approve, record and reconcile. If they do, that person can both cause and conceal a problem.
- The minimum split is two-person: finance DOES the action, the founder or department head APPROVES it. Finance never self-approves.
- Compensating controls fill the gap when you cannot split every duty: owner review, maker-checker on payments, the system audit log, and bank-feed review.
- The founder is the checker. Eyeball transactions as they happen, review ALL expenses at month-end, and personally release bank payments.
- Never mix these: whoever negotiates a vendor’s terms should not also onboard that vendor. Recording and reconciling stay apart too.
| 4 Incompatible duties: initiate, approve, record, reconcile | 2 People are enough: one does, one approves | 0 Self-approvals allowed, at any team size |
The Four Incompatible Duties
Segregation of duties is one idea: no single person should control a transaction from start to finish. Every financial transaction moves through four steps, and the whole point of segregation of duties, in a small business or a large one, is to make sure the same person does not hold all four. If they do, that person can create an error or a fraud and then hide it, because nobody else ever touches the transaction.
The danger is concentration. A person who can initiate a fake vendor bill, approve it, record it and then reconcile the bank so it all ties out has a clear path to move money and erase the evidence. Segregation of duties breaks that path by putting a second person somewhere in the row. The rules behind these controls belong in your written policy: read the full guide to lean startup controls in the Finance SOPs and Controls pillar.
The Problem on a One-Person Finance Team
Here is the honest bit that most control frameworks skip: a startup with one accountant cannot put four duties in four different hands. You do not have four hands. So the textbook version of segregation of duties is impossible, and if you measure yourself against it you will always fail. That is not a reason to give up. It is a reason to redesign the control around the people you actually have.
- Accountant raises the bill
- Accountant approves it (no one checks)
- Accountant records it
- Accountant reconciles the bank
- Result: a mistake or fraud is invisible
- Finance initiates, records and reconciles
- Founder or dept head approves
- Founder releases the bank payment
- Founder reviews ALL expenses at month-end
- Result: nothing completes unseen
“Even a one-person finance team should never be able to self-approve. Finance does the action, and the founder or the head of that department approves it. That single split is worth more than any org chart.”
Ankit Sarawagi, from building finance functions in lean startupsThe Minimum Split You Must Always Keep
The realistic minimum for segregation of duties in a small business is not four roles. It is one rule: finance DOES the action, and someone else APPROVES it. Finance never approves its own work. On a lean team that second person is the founder or the relevant department head, and two sets of eyes is genuinely enough to break the concentration risk. Everything else is a layer on top of this.
The baseline control is a maker and a checker. The maker (finance) prepares; the checker (founder or department head) approves. Sensitive items always go to the founder: new vendors, salary changes, and any change to bank details. Genuinely strategic amounts go to the board, at the threshold set by your investment agreement or SHA reserved matters, not an arbitrary number.
Lean version (5 to 30 people): finance is the maker for everything; the founder is the single checker and approver. When to add a step as you scale: once you have a finance manager plus a separate accounts executive, move day-to-day approvals to the finance manager and reserve the founder for sensitive and above-threshold items, so the founder is not the bottleneck on every ₹5,000 bill. See how approvals are structured in the approval matrix SOP.
Compensating Controls for Lean Teams
When you cannot split every duty, you use compensating controls: checks that substitute for a missing separation. They are how a two-person team gets the safety of a four-person one. Four of them do most of the work for a lean startup.
Every approval should leave a record inside the tool itself: the approval in Zoho Books or Zoho Payroll, the maker-checker release log in the bank portal, the edit log in your accounting software. If you approve on email, Slack or WhatsApp for speed, capture it back into the record (save the message to the tool or the file) so it stays audit-defensible. In India, accounting software must keep an audit trail (edit log) that stays on, and auditors check it.
The Founder’s Compensating Routine
On a tiny team, the founder is the compensating control. That does not mean drowning in approvals; it means three habits that, together, ensure no transaction completes without an independent eye on it.
If you do only one thing, make the founder the person who releases payments in the bank. Even if finance records, initiates and reconciles, they cannot move the cash. See the full flow in the payment release and maker-checker SOP.
Pairs You Must Never Combine
Even at five people, some duty pairs must stay in different hands, because combining them defeats the whole control. The founder can always be the second party. This is the never-one-person rule.
| Duty A | Duty B | Why they must stay apart |
| Approve a payment | Release it in the bank | Combining them removes the checker, so cash leaves on one person’s say-so. |
| Record a transaction | Reconcile the bank | The person who booked the entry can hide their own error or fraud in the reconciliation. |
| Negotiate or decide vendor terms | Onboard that vendor | One person could set up a supplier they control end to end, terms and master data both. |
Startups get caught not because they lack controls, but because they never document them. Auditors and diligence teams do not expect a big-company SoD matrix at five people; they expect you to show the process, the approval and the audit log. Run the maker-checker but capture nothing, and on paper you have no control at all.
“You will never get perfect segregation of duties at five people, and no serious auditor expects it. What they expect is that you saw the risk, put in compensating controls, and can show the trail. That is entirely achievable on a tiny team.”
Ankit Sarawagi“Segregation of duties on a lean team is not about having more people. It is about making sure that whatever one person does, a second person, usually you, the founder, sees before it is final.”
Ankit Sarawagi, CFOmatrixFrequently Asked Questions
What is segregation of duties?
Segregation of duties (SoD) is the internal control principle that no single person should handle all parts of a financial transaction. The four duties that should not sit with one person are initiate (start the spend), approve (authorise it), record (book it) and reconcile (independently check it against the bank). If one person does all four, they can create, hide and cover up an error or a fraud with nobody else ever seeing it.
How do small teams achieve segregation of duties?
On a lean team you cannot split four duties across four people, so you aim for the realistic minimum: finance DOES the action and the founder or department head APPROVES it, so finance never self-approves. You then add compensating controls: owner review, maker-checker on bank payments, the audit log inside your accounting and payroll software, and bank-feed review. Even a one-person finance team can hit this bar, because the second set of eyes is the founder.
What are compensating controls?
Compensating controls are checks that substitute for full segregation of duties when you do not have enough people to split every duty. The four that lean startups rely on are owner or founder review, maker-checker on payments (one prepares, another releases), the system audit trail or edit log inside accounting and payroll tools, and regular bank-feed and reconciliation review. Together they mean one person still cannot initiate, approve, record and reconcile without someone else seeing it.
What should the founder personally check?
On a tiny team the founder is the compensating control, so the founder should eyeball every meaningful transaction as it happens, run a month-end review of ALL expenses and approve them there, and personally release or approve bank payments as the checker, so finance prepares payments but the founder authorises them. The founder should also always approve sensitive items: new vendors, salary changes and any change to a vendor’s or employee’s bank details.
Which duties must never be combined?
The pairs to never combine in one person are approving a payment and releasing it in the bank (that removes the checker), recording a transaction and reconciling the bank (that lets an error hide itself), and negotiating or deciding a vendor’s terms and also onboarding that vendor into your system (that lets one person set up a supplier they control end to end). Even at five people you can keep these pairs apart by using the founder as the second party.
Do auditors expect segregation of duties in a startup?
Auditors and due-diligence teams know a five-person startup cannot run a large-company control matrix, so they do not expect perfect SoD. What they expect is that you have identified the risk, put compensating controls in place, and can show the paper trail: the documented process, the approval and the audit log inside your software. In India, accounting software must keep an audit trail (edit log) that stays switched on, and auditors check it. Doing the control but never documenting it is what gets startups caught.
This is general educational information for founders, current to mid-2026, drawing on the author’s experience building finance functions in lean startups, and is not legal, tax or audit advice. Control expectations and requirements (including the accounting-software audit-trail rule, CARO and internal financial controls reporting) change and apply by threshold; verify the current position or consult a professional before acting on a specific matter.
Payment Release and Maker-Checker
Finance SOPs and Controls: The Lean Startup Guide
AS | Founder, CFOmatrix | Finance Strategy & Equity Compliance CFOmatrix is a knowledge platform focused on how finance actually works inside growing companies. This SOP draws on hands-on experience building right-sized controls in lean startups, where perfect segregation of duties is impossible and compensating controls carry the weight. |