Segregation of Duties When a Founder Delegates Financial Work

Published September 22, 2026.

Segregation of duties when delegating money tasks

Segregation of duties is an internal control principle that divides the stages of a transaction among different people so that no single individual can both cause and conceal an error or a fraud. It matters to founders because the same delegation that reclaims time can also concentrate financial power in one remote assistant. Bookkeeping, invoice entry, bill payment, expense reimbursement, payroll, and vendor onboarding are individually routine and collectively dangerous when they sit with one person. This review examines what authoritative control frameworks and fraud research say, and translates them into a design a small business can operate with a virtual assistant.

The four stages that should not sit together

Control literature describes a transaction as passing through several stages. Someone authorizes the transaction. Someone has custody of the asset or the account. Someone records the transaction in the books. Someone reconciles the record to an independent source such as a bank statement. The risk rises when one person performs incompatible combinations: authorizing a payment and holding the bank credentials, adding a vendor and approving that vendor's invoice, processing payroll and controlling the direct deposit list, or recording expenses and reconciling the credit card.

The principle is not that delegation is unsafe. It is that the business should decide which stages a single person may own and which stages must be separated or checked. For a small team, that decision is a design exercise, not a slogan.

What NIST controls establish

The NIST Special Publication 800-53 control catalog is a widely used security and privacy control baseline. Control AC-5, Separation of Duties, directs organizations to identify duties that need separation, define the authorized assignments, separate the duties of individuals as needed, and document any separation of duties. Its implementation guidance adds an important small-business accommodation: where separation of duties is not possible, organizations can apply compensating controls such as audit logging, mandatory vacations, job rotation, and independent review.

Two related controls reinforce the design. AC-6, Least Privilege, limits each account to the access required for its function, so an assistant who enters invoices does not need payment approval rights. AU-2 and AU-3, which govern audit events and record content, give the business a traceable record of who did what. Together these controls describe a practical posture: narrow the access, separate the decisions, and log the activity so a later review can reconstruct it.

What fraud research adds

The Association of Certified Fraud Examiners publishes periodic research on occupational fraud based on cases reported by examiners. Its reports consistently find that a large share of frauds occur in organizations with weak internal controls, that small organizations suffer disproportionate losses relative to their size, and that tips are among the most common detection methods. The reports also describe common schemes that map directly onto delegated finance: billing schemes using fictitious or inflated vendors, expense reimbursement manipulation, payroll schemes, and check or payment tampering.

The actionable finding is not a specific statistic but a pattern. Schemes that require a single person to both create and approve a payment are the ones that controls are designed to interrupt. The same research tradition also notes that frauds tend to run longer when detection depends on external audit rather than on internal review. A founder who reviews transactions on a fixed cadence shortens that window.

A delegated finance design

The federal Start with Security guidance from the Federal Trade Commission and the IRS guidance on safeguarding business data both emphasize limiting access to what a role requires and protecting credentials. Combining those with NIST AC-5 and AC-6 produces a design that keeps delegation useful:

• Keep bank and payment-platform credentials with the founder or a second person. The assistant prepares payments; the founder releases them.
• Separate vendor onboarding from payment approval. A new payee requires an independent verification step, using a phone number already on file rather than one supplied in an email.
• Use read-only accounting access for the assistant and a separate approval role for the founder. Reconcile one account independently each month.
• Require dual authorization above a threshold, and keep that threshold low enough that it catches ordinary transactions, not only large ones.
• Issue a business card with a hard limit for the assistant rather than a card tied to a primary operating account.
• Review accounting software audit logs on a schedule, and keep the logs in a system the assistant cannot edit.
• Rotate duties periodically and require the assistant to take planned time away so that continuous schemes are more likely to surface.

For businesses where one assistant must perform several steps, the compensating controls from AC-5 become the substitute: mandatory review, rotation, and independent reconciliation. The point is to make concealment require more than one person's cooperation with the system.

Protecting yourself without signaling distrust

A common objection is that controls feel like an accusation. The framing that works is procedural rather than personal. Controls apply to every finance role, they are documented in the scope of work, and they are presented as part of onboarding rather than as a response to suspicion. Written approval thresholds and a monthly reconciliation calendar are easier to accept than an improvised request for documents, and they protect the assistant as much as the founder, because a clear trail shows what was authorized.

It also helps to connect the finance design to the rest of the assistant's access. Our review of virtual assistant access and account security explains how credential scope and multi-factor authentication support the same goal, and our evidence review of delegation risk controls frames the broader control set.

What controls cannot do

No control design eliminates fraud or error, and a determined insider with legitimate access can defeat a weak process. Controls reduce opportunity and create evidence; they do not replace hiring judgment, reference checks, or professional advice. Very small businesses sometimes cannot achieve full separation and accept residual risk, which is precisely why documenting the compensating controls matters: it shows that the risk was understood and managed rather than ignored. Founders should also confirm that the control design matches their accountant's expectations and their insurer's requirements, since professional and cyber policies sometimes depend on documented controls.

Methodology and limits

This review examined the NIST Special Publication 800-53 control catalog entries on separation of duties, least privilege, and audit logging; the Association of Certified Fraud Examiners research program on occupational fraud; the Federal Trade Commission's Start with Security guidance; IRS Publication 4557 on safeguarding taxpayer and business data; and the Small Business Administration's guidance on managing employees. Each source was checked on September 22, 2026. The review synthesizes control principles for a small business; it does not audit any specific company, does not measure the fraud rate in delegated arrangements, and does not provide accounting, legal, or insurance advice. Control frameworks describe what is prudent, not what is legally mandated for every business.

Frequently asked questions

Can I give my virtual assistant access to my bank account? Access and authority are different. Many businesses let an assistant view transactions while reserving payment initiation and approval for the founder or a second person.

What if I only have one assistant? Use compensating controls: independent reconciliation, mandatory review, limited access, transaction limits, and scheduled time away. Document why full separation is not feasible.

Does segregation of duties slow down payments? It adds a review step, not necessarily a delay. A threshold and a daily release window keep routine payments moving while preserving a second set of eyes.

Is this only about fraud? No. Separation also catches errors, duplicate payments, and unauthorized charges, which are far more common than intentional fraud.

References

1. Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5), National Institute of Standards and Technology
2. Report to the Nations, Association of Certified Fraud Examiners
3. Start with Security: A Guide for Business, Federal Trade Commission
4. Safeguarding Taxpayer Data: A Guide for Your Business (Publication 4557), Internal Revenue Service
5. Hire and Manage Employees, U.S. Small Business Administration