Segregation of duties: no one person does it all

On small and mid-sized warehouses the picture is familiar: the storekeeper receives goods, enters them into 1C, issues them, prepares the write-off and counts them at the stock take, all alone. It is quick and convenient, but there is nobody to catch one person's mistake or dishonest act. Segregation of duties closes that gap: the chain of a single operation, from start to finish, is spread across different people.

Four functions, four different people

Every operation has four functions:

• Authorisation: the person who approves an order or a write-off.
• Custody: the person who physically holds the goods, i.e. the storekeeper.
• Recording: the employee who keeps documents and 1C entries.
• Control: the person who independently reconciles balances with documents.

The rule is simple: two of these functions, above all custody and recording, must not rest with the same person. If the one holding the goods can also change the records, they can hide a shortage in the books, and spotting it is almost impossible.

For example, a storekeeper posts part of the stock in 1C as "damaged" while in fact selling it personally. If a manager approves the write-off and a second employee must also sign the damage report, the scheme fails: it needs at least two people, and getting them to agree is much harder.

How it is divided in practice

• Receiving is done by the storekeeper and a second employee together, and both sign the delivery note.
• Receipts are entered in 1C not by the storekeeper but by an operator or accountant.
• A release order comes from the sales department; the storekeeper does not hand out goods without one.
• Write-offs and stock adjustments are approved by a manager or the finance department.
• On the stock-count commission the storekeeper does not count personally: they show the goods and others count.
• Settlements and payments to suppliers are handled by someone other than the storekeeper.

The most important pair is custody of the goods and the right to correct balances. If you cannot change everything at once, at least give these two to different people.

When a small company cannot divide the work

In a warehouse with one or two employees it is impossible to share four functions among four people. Compensating controls apply instead:

• the owner or manager personally recounts 10–15 randomly chosen items once a week;
• only the owner approves adjustments and write-offs (with a separate permission in 1C);
• at the end of each month the list of adjustments goes to the owner;
• the storekeeper takes at least two weeks of leave a year and someone else covers: that is often exactly when hidden errors come to light;
• a camera watches the entrance and the valuable-goods zone.

These measures do not fully replace segregation of duties, but they cut the risk considerably: the storekeeper knows that a surprise count may come on any day, and that is a barrier in itself.

Access rights in 1C

If the rule exists on paper but the program lets everyone do everything, the rule does not work. Give each employee a role in 1C or another program: the storekeeper sees receiving and issuing documents but cannot edit balances; the operator enters documents but does not approve; only the manager makes adjustments. Print the permission table (employee × action) on a single sheet, and both you and the auditor can see a conflict at a glance.

How the auditor tests this

The auditor compares the permission table with the program settings, then takes a sample of documents and looks at who created, approved and physically carried out each one. If the same user name appears at every stage, that is a signal. Another dangerous situation is a shared login: if three people work under one password, segregation of duties falls to zero because who did what can never be established. At the end the auditor hands over a list of "conflicts". For example, "the storekeeper can also edit the receipt document in 1C" is a serious finding; "the operator and the accountant have identical rights" is a lesser one.

Conclusion

Segregation of duties is not distrust of an honest employee; it is a rule that protects them from suspicion as well: when every operation passes under two sets of eyes, there is no need to hunt for someone to blame when an error or doubt appears. In a review, OmborAudit looks at permissions and areas of responsibility and shows the weak points.