Segregation of Duties in Payroll: The Control Auditors Ask About First

The three hats

Payroll has three jobs that should never live in one pair of hands:

• Changing who gets paid — hiring, terminations, pay rates, bank account details.
• Running the payroll — processing hours, approving the register, submitting the run.
• Touching the money — funding the account, reconciling the bank statement, seeing what actually left.

Someone wearing hat one and hat two can invent a ghost employee and pay them. Someone wearing hat two and hat three can pad a run and smooth over the reconciliation that would have caught it. Someone wearing all three can do anything, indefinitely — and at small companies, one office manager or bookkeeper wearing all three is not the exception, it's the default org chart.

Worth saying out loud: implementing this control is not an accusation. The person most protected by segregation of duties is your honest bookkeeper — because when money goes missing and one person had all the keys, suspicion lands on them whether they took it or not. Framed that way, good employees tend to want the control.

If you have five employees

You can't split three roles you don't have three people for. What you can do is keep one hat for yourself — the cheapest version of the control is the owner holding the money hat:

• Review the payroll register before every release. Two minutes: headcount right, names recognized, totals in the normal range, nothing off-cycle you didn't expect.
• Have the bank statement come to you — unopened, directly, every month. Skim the payroll account even if someone else does the formal reconciliation. Fraudsters count on nobody looking.
• Turn on bank alerts for payroll-account transactions over a threshold and for any change to direct-deposit details. Most payroll platforms and banks will notify on both; almost nobody enables it.
• Approve every new hire personally before they enter the payroll system. At five employees you know everyone — the control costs nothing.

None of this requires software you don't already have. It requires the owner accepting that “I trust her completely” is a description of the risk, not a control. The trusted, tenured, never-takes-vacation employee is the profile in case after case — not because trust is foolish, but because trust without verification is exactly the environment a scheme needs to run 13 months.

If you have twenty to a few hundred

Now you have enough people to actually split the hats — and a system that can enforce the split instead of relying on habit:

• HR (or the hiring manager) owns roster changes. Payroll processes what HR has authorized, and can't add employees themselves.
• Payroll runs the register. Someone in finance — not payroll — reconciles the bank account monthly.
• Use role permissions, not shared logins. Modern payroll platforms like Gusto and Rippling support scoped admin roles; the control only exists if the roles are actually configured. A shared “admin” login is all three hats on a sticky note.
• No self-approval, anywhere.Managers don't approve their own time or expenses; payroll staff's own paychecks get reviewed by someone else.
• Cross-train and require real vacations. Schemes need daily tending. The books that can never be handed to a substitute are the books most worth looking at — mandatory time off is quietly one of the best fraud controls in existence.

Write it down, then test it

The whole policy fits on one page: who holds which hat, who covers during absences, and the rule that no single person adds a payee and pays them. Then verify it's true in practice — system permissions drift as people change roles, and the person who “temporarily” got payroll admin during a maternity cover still has it three years later. The access checks in our payroll audit checklist are the test; run them quarterly.

And if separation reveals something already happened — payments you can't explain, a name nobody knows — move carefully and quickly: how to report payroll fraud covers the order of operations, including the parts to do before confronting anyone.