Segregation of AP Duties
What's the Best Approach?
Posted by Steve Wilcox on Fri, Feb 06, 2009 @ 03:27 PM
Question: What do the following situations all have in common?
- A policeman ticketing a Dunkin' Donuts truck driver ...
- A doctor prescribing medicine from a pharmaceutical company in which he owns stock ...
- A politician accepting contributions from a special interest group ...
- A procurement manager being wined and dined by vendors ...
- A hungry wolf guarding the chicken coop ...
- A judge sentencing a family member ...
- Coaching your own son or daughter on a travel team ...
Answer: In each situation, there is a conflict of interest.
A conflict of interest is a situation where someone (such as a doctor,politician, procurement specialist, police officer, judge, coach, wolf etc.) has a personal interest or motivation that might compromise the reliability and integrity of bigger obligations.
In many cases - especially where money is involved - a conflict of interest may tempt someone to break the law. Nowhere is this truer than in Accounts Payable.
In AP, there are a lot of conflicting duties which should always be segregated. Segregating AP duties is one of the most important internal controls in finance. For example, the person entering the invoice should not approve the invoice for obvious reasons. Similarly, the person who sets up a vendor should not enter the invoice into the ERP system. There are many examples in AP where duties should be segregated. The problem is that most finance departments constantly have pressure to do more with less. But to follow segregation of duties to the letter, you need enough staff which isn't always a luxury - especially in these economic conditions.
But wait!
Haven't ERP systems addressed segregated duties through a security framework which governs the acceptable use for each authorized user?
Aren't roles and responsibilities managed so that, for example, an entry-level accounts payable clerk can access modules only related to her specific job function while the CFO can access any module in the system?
Well ... yes ... but the problem of trying to maintain segregated duties using this classification approach is that these configurations are expensive to design and deploy. As employees are promoted, reassigned, or terminated, organizations must continually update their ERP systems with everyone's correct authorization level including consultants, contractors and business partners. Supporting and maintaining the classifications and configurations is a resource intensive job.
Furthermore, most organizations struggle with their initial ERP setup -- millions are spent in projects that can take up to 3 or more years. Unfortunately, the setup of these segregated classifications is often the last phase of the project and does not receive the attention it requires especially if the project is over budget or behind schedule - which is more common than not.
With AP automation that includes a robust workflow engine, you should have complete end-to-end AP process visibility as the invoice transitions from one step to the next ... the AP system should track all changes maintaining a comprehensive audit trail of what was performed and by whom for all prior steps so potential conflicts can automatically be caught at the transaction-level.
Using this approach, limited headcount can still allow for segregated duties since segregation can be enforced at the transaction level instead of the job role level. Employees can still be cross trained and allowed to perform multiple functions as long as they don't perform conflicting duties on the same transaction. For example, an AP Specialist could both enter invoices and also setup suppliers as long as there is no conflict on each and every transaction.
This transaction-level segregation can be enforced by the workflow software which allows you to move away from restrictive job role controls ... rather than limiting what functions employees can carry out as part of their jobs, this approach allows enterprises to boost productivity while mitigating the business risks.
One last point here ... this approach requires less overhead since segregation rules are defined once at the process level as opposed to the constant overhead of ERP administration.
-Rakesh Shukla
@rakesh170
Related White Papers
Related Blog Posts