Short answer
Segregation of duties means splitting a transaction so that no single person can create it, approve it, record it and release the money or goods. In digital workflows it is enforced through roles and permissions in each system. Small teams that cannot fully separate roles can keep the principle with a second approval above a low limit, protected supplier and bank data, and a regular independent review of exceptions. AI agents should get their own identity and limited rights, never a person's login.
What is segregation of duties?
Segregation (or separation) of duties is one of the oldest internal controls. The idea is simple: the steps of a sensitive transaction are split between people so that one person's mistake or dishonesty is caught by another. The classic split covers four kinds of duty:
| Duty | Example in purchasing |
|---|---|
| Initiate | Raise a purchase request |
| Authorise | Approve the request or the payment |
| Record | Enter the invoice and post it in the accounts |
| Custody | Release the payment, or receive and hold the goods |
No one person should hold two incompatible duties for the same transaction, especially "authorise" and "custody".
Why does segregation of duties matter now?
Because weak or bypassed controls remain a main way losses happen. The Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations, released in May 2026, analysed 2,402 cases across 143 countries and territories and found that more than half involved either a lack of internal controls or an override of existing controls (ACFE).
Digital risk adds to this. Verizon's 2026 Data Breach Investigations Report, published on 19 May 2026, found that breaches involving a third party now make up 48% of the total, and that employee use of unapproved "shadow AI" tools rose from 15% to 45% in a single year (Verizon). When suppliers, shared logins and unsanctioned tools sit inside a process, the question "who can do what" gets harder to answer, and more important.
How does segregation of duties work in digital workflows?
In paper processes, segregation came from different people signing different forms. In digital processes it lives in the configuration of each system:
- Roles, not individuals. Define roles such as requester, approver, accounts payable clerk and payment releaser, and assign people to roles.
- Conflict rules. The system blocks one user from approving their own request, or from both changing supplier bank details and releasing payments.
- Named accounts. Every person, and every bot or agent, has its own login. Shared accounts make segregation impossible to prove.
- Admin rights kept apart. The people who can change roles and limits should not be the people who use them every day.
- Across systems. Check segregation end to end. A person may be blocked in the accounting system but able to change bank details in the banking portal.
How can a small team keep segregation of duties?
In a team of three or four in finance, full separation is often impossible. The principle can still be kept with compensating controls:
- Two people for money out. Payments are prepared by one person and released by another, or need two signatories in the banking system.
- A second approval above a low limit. The owner or general manager approves anything above an agreed threshold.
- Protected master data. Supplier creation and bank detail changes need a call-back to a known number and approval by someone other than the requester.
- Independent review. Each month someone outside the process reviews a sample of payments, all overrides and all changes to supplier data.
- Logs that cannot be edited by the people whose actions they record.
Our guide to controls before automating approvals includes a sample approval matrix that builds these rules in.
What about AI agents and bots?
Automation can strengthen segregation, because a system applies the rules every time. But a bot or AI agent is also a user. If it runs under a person's login, its actions look like theirs, and that person effectively holds every duty the bot performs. Give each bot or agent its own account, with only the rights its task needs, and keep a person approving actions that move money or change master data. See which AI agent actions need human approval.
Update, 29 July 2026: IBM's 2026 Cost of a Data Breach Report found that one in four malicious breaches were AI-enabled and that more than 20% of organisations reported a breach targeting AI models or applications (IBM, 29 July 2026). AI tools with broad access are now targets in their own right.
Update, 27 October 2026: NIST published design tenets for agent identity management stating that agents should have an identity, credential and access lifecycle distinct from human users, to prevent impersonation and keep autonomous actions traceable (NIST, 27 October 2026).
Linkgrow's controls and cyber review checks segregation of duties across your systems, including bots and agents. The free gap finder is a quick place to start.
Frequently asked questions
What is an example of segregation of duties?
In purchasing, one person raises the request, a manager approves it, accounts payable records the invoice, and a different person releases the payment.
What if our team is too small to separate duties?
Use compensating controls: two people for any payment, a second approval above a low limit, protected supplier bank details and an independent monthly review of exceptions.
Does automation remove the need for segregation of duties?
No. It moves segregation into roles and permissions. Someone still configures the system, and bots and agents need their own limited accounts.
Should an AI agent have its own login?
Yes. A separate identity with only the needed rights keeps its actions traceable and stops it from inheriting a person's full access.
Sources
Where are the gaps in your operations?
Find your gaps