Segregation of duties (SoD) is a core internal control. Classic splits in construction accounting: the person who enters a bill doesn’t approve it; the person who approves bills doesn’t release payments; the person who changes vendor bank details doesn’t approve the change; the person who reconciles the bank doesn’t release payments; the person who runs payroll doesn’t approve pay rate changes.
Small companies can’t split everything, so they compensate with review: an owner reviewing the bank reconciliation and every vendor bank change, for example.
Why it matters
Most occupational fraud at contractors involves billing schemes, check tampering or payroll, and each one needs one person to control a whole transaction. SoD breaks that chain.
Worked example
An AP clerk enters a $60,000 bill. It routes to the PM, then the controller. Payment is released by a third person who didn’t enter it. A vendor bank change requested by the clerk needs a second approver and a call-back first (illustrative).
Common mistakes
- Admin rights for everyone “to keep things moving”.
- Controls in the UI only, which an import or API call can skip.
How os.construction handles it
In the accounting preview, maker-checker is enforced by the server: whoever prepared or contributed to a journal entry, bill, invoice, receipt, pay run or close checklist cannot approve it. See Security and controls.