Separating bookkeeping from bill-pay is one of the most effective financial controls a small business can put in place, and one of the least implemented. It doesn't require a large finance team or expensive software. It requires two people, two sets of responsibilities, and the discipline to keep them separate.
Most small business fraud doesn't look like fraud when it starts.
It looks like a routine vendor payment. A payroll entry that's slightly off. A recurring expense that nobody questions because it's always been there. The kind of thing that gets waved through because the person reviewing it is the same person who created it.
That's the problem this post is about. Here's why separation works, what it prevents, and how to put it in place.
What Segregation of Duties Actually Means
Segregation of duties is an accounting principle that's been around for decades. The core idea is straightforward: no single person should control every step of a financial transaction. When one person can initiate a payment, record it in the books, and reconcile the account, there is no independent check on what they've done.
In a large company, this is handled by organizational structure. The AP clerk submits invoices. A manager approves them. The bookkeeper records them. Finance reconciles. Nobody has full access to the entire chain.
In a small business, those functions often collapse into one or two people. That's understandable, because headcount is limited and everyone wears multiple hats. But the financial risk that comes with it is real and specific. It's also the most common reason small businesses bring in an outside bookkeeper: not because the work is too hard, but because the second set of eyes has to come from somewhere.
The two functions that matter most to separate are:
- Recording and categorizing transactions (bookkeeping)
- Approving and executing payments (bill-pay)
When one person does both, the doors that fraud requires to stay open are open. When those functions belong to different people, the same doors become substantially harder to get through.
The Fraud Patterns Combined Access Makes Possible
Understanding why separation matters starts with understanding what it prevents. These are not theoretical risks. They are documented, recurring fraud patterns that exploit exactly the gap that combined bookkeeping and bill-pay access creates.
Ghost Vendors
A ghost vendor is a fake supplier that exists only on paper. Someone with both bookkeeping and payment authority creates a vendor record, submits invoices under that vendor's name, approves the payment, and redirects the funds to an account they control. The transactions look legitimate in the books. The approvals look routine. Nothing surfaces because there's no second person in the process to ask "do we actually use this vendor?"
Ghost vendor fraud is particularly hard to detect after the fact because the documentation is designed to look real. It's discovered, when it is discovered, by someone who notices a vendor they don't recognize, usually during an audit, a bookkeeper transition, or a loan application review.
Inflated or Personal Expenses
When the same person records expenses and approves payments, they can misclassify personal costs as business expenses and pay them without a second signature. This happens at every scale, from a few hundred dollars in personal groceries recorded as office supplies, to consistent misclassification of personal travel, car payments, or home utilities. Each individual transaction may be small enough to escape notice. Cumulatively, over months or years, the total can be significant.
The control that stops this isn't an audit. It's a second person reviewing what was paid before it leaves the account.
Duplicate Payments
A duplicate payment sends the same invoice through twice. In a manual process, this can be accidental. When it's intentional, it's a way to extract funds by paying a real vendor's legitimate invoice twice, keeping the second payment, while the vendor either refunds it (at which point the refund is intercepted) or doesn't notice.
Duplicate payment schemes rely on the fact that the person making payments is also the person who would notice the duplicate in the books. Separate those functions, and the bookkeeper's reconciliation will surface the discrepancy before it becomes a loss.
Unauthorized Payroll Changes
Payroll fraud takes several forms, but the most common involve someone with both bookkeeping and payroll processing access either inflating their own pay, adding a ghost employee to the payroll, or failing to remove a terminated employee's record and redirecting their payments. These changes are made in the system by the same person who would normally catch them in the reconciliation. This pattern shows up often in practices where one person handles both billing and the books, which we covered in how a billing coordinator's access affects a medical practice.
A business where payroll is processed by one person and reviewed by a second, even informally, even just the owner looking at a summary, is significantly less vulnerable to this than one where the same person does both and reports only to themselves.
How Separation Disrupts Each of These Patterns
The mechanism is simple: fraud in financial systems almost always requires the ability to both create and approve a transaction. Separation eliminates that.
When the bookkeeper records transactions but cannot make payments, a ghost vendor payment requires a second person to approve it, someone who will ask who the vendor is, what was purchased, and whether there's documentation. That question, asked routinely as part of the approval process, is frequently all it takes.
When the person approving and making payments isn't the person reconciling the books, discrepancies surface. A duplicate payment that the payer might overlook becomes visible to the bookkeeper during reconciliation, because the account activity doesn't match the records.
When payroll is processed by one person and reviewed by another, changes that were designed to go unnoticed get noticed, because the reviewer has no reason to overlook them.
None of this requires suspicion. It doesn't require assuming that your staff or bookkeeper is dishonest. It requires recognizing that a system without independent checks is one where honest errors and dishonest ones look identical until someone independent reviews them. Separation is what makes review possible.
The businesses that catch fraud early almost always have one thing in common: two people whose records have to match.
What This Looks Like in Practice
You don't need a finance department to separate these functions. You need clarity about who does what, and a consistent process for maintaining the separation.
The Simplest Version
- Your bookkeeper records, categorizes, and reconciles transactions
- You (the owner) review and approve payments before they go out
- Your bookkeeper does not have payment authority on your bank accounts
- You do not manage or reconcile the books yourself
This split is achievable even with a single bookkeeper and a single owner. It requires that the owner actually reviews and approves payments rather than delegating that entirely, but the time investment is typically 30 to 60 minutes a week, not a second job.
For Businesses With Slightly More Structure
- Bookkeeper records and categorizes transactions in accounting software
- Office manager or operations lead reviews invoices against purchase orders and submits for approval
- Owner approves anything above a defined threshold
- Bookkeeper reconciles accounts monthly and flags discrepancies to the owner
- No single person has both bookkeeping access and bank account payment authority
Practical Controls That Support the Separation
- Separate login credentials for your accounting software and your banking platform
- Bookkeeper has read access to bank feeds (for reconciliation) but not payment authority
- A defined approval threshold, for example anything over $500 requires owner sign-off
- A vendor change policy: any new vendor or banking detail change requires verbal verification from a second person before a payment is processed
- Monthly owner review of the vendor list and payroll register, looking at who was paid, not just the total amount
These controls don't require software changes or significant cost. Most accounting platforms and banking systems already support the access level configurations that make this possible.
The Objections, and Why They Don't Hold
"I trust my bookkeeper."
Segregation of duties is not about trust. It's about system design. A trustworthy bookkeeper working inside a well-designed system is protected as much as the business is, because if a discrepancy ever surfaces, the controls document that they didn't cause it. A trustworthy bookkeeper working inside a system with no independent checks has no such protection, and neither does the business.
"We're too small to have two people involved."
In a very small business, the owner is often the second person. The separation doesn't require a dedicated finance employee. It requires the owner to stay in the payment approval loop rather than delegating that function entirely. For businesses where even that is difficult, the minimum viable version is a monthly review of what was paid: not just the total, but the vendor list, the payroll register, and the reconciliation report.
"My bookkeeper has always handled everything."
That may be true, and it may have worked well. But "it has always been fine" is not the same as "the controls are in place to make sure it stays fine." The value of separation isn't visible when everything is going well. It's visible when something goes wrong, either because it prevents the loss entirely, or because it surfaces the problem early enough to limit the damage.
No internal control is foolproof. But separation of duties is one of the few that makes fraud structurally harder, not just technically possible to detect after the fact.
The Bottom Line
The businesses that catch fraud, and the businesses that prevent it, are not necessarily larger, more sophisticated, or better staffed than the ones that don't. They have processes that require two people's records to match.
Separating bookkeeping from bill-pay is the foundational version of that control. It creates an independent check at the point where fraud most commonly enters: the transaction that one person can both create and approve without anyone else seeing it.
It is one of the simplest, most durable financial controls available to a small business. It costs very little to implement. And the cost of not having it, when it matters, is almost always higher than anyone expected.
At Salt & Sand Bookkeeping, we work with business owners to build the financial controls that protect what they've built. Not just clean books, but the processes that keep them that way. If this raised questions about how your bookkeeping and payments are currently structured, that conversation is worth having.
See how we structure books and controls for small and mid-sized businesses: Our Bookkeeping Services
Questions about your books? Reach us at info@saltandsandbookkeeping.com or (619) 304-SALT (7258).
Not sure how your bookkeeping and payments are currently split? Let's talk.
Schedule a Free Consultation