Segregation of Duties for Offshore Finance Teams in India

Could one person on your finance team set up a supplier, approve its invoice, and release the payment? If the answer is yes, you have a segregation of duties problem, and it is one of the first things an auditor will test.

This guide is for controllers, finance leads, and founders who are building or extending a finance team in India and need the control structure to survive an audit or a customer security review.

We help global companies hire reconciliation accountants and controls analysts in India through our Employer of Record service, which is often the most direct way to close a segregation of duties gap.

Most articles on this topic explain the principle and then leave you stuck, because the honest answer for a small team is that you cannot fully separate four duties across three people.

So we cover what the standards actually permit when the team is too small, a conflict matrix you can copy, and the point at which adding one person in India is cheaper than stacking another compensating control.

What is segregation of duties?

Segregation of duties is an internal control that splits a transaction across more than one person, so no individual can both cause a problem and hide it. It is one of the oldest ideas in accounting and still one of the most effective.

The logic is simple. Fraud and error both survive on a lack of a second pair of eyes.

It is worth clearing up a common misreading straight away. This control is not primarily an anti-fraud measure, even though that is how it gets sold internally.

In practice it catches far more honest mistakes than deliberate ones. Someone keys a payment to the wrong account, and because a different person reconciles the bank, it surfaces the same week rather than at year end.

That framing matters when you are asking for headcount, because "we might get defrauded" is a weaker argument than "we currently have no way to catch a keying error". It sits alongside the wider risk management picture rather than apart from it.

So which duties actually need to come apart?

What are the four duties you should separate?

Authorization, custody, record keeping, and reconciliation. Someone approves the transaction, someone else controls the asset, someone else records it, and someone independent checks the result. Holding two of these creates risk. Holding all four removes the control.

Almost every real control failure traces back to one person quietly holding two of these four.

Here is what each duty covers and what goes wrong when it is combined with another.

Read the last row carefully, because it is the one most often broken by accident. A reconciliation performed by the person who made the entries is documentation, not control.

This is why the reconciliation step is usually the first one teams move to a separate owner during the record to report cycle.

Turning that principle into something you can audit against means writing it down as a matrix.

What does a segregation of duties conflict matrix look like?

A conflict matrix lists the sensitive tasks in a process and marks which pairs one person must never hold together. It turns a principle into a checkable rule, which is what an auditor or a system administrator can actually work from.

Most teams never write one, which is how conflicts creep in during a busy quarter and stay there.

Below is a purchase-to-pay example. The same structure works for payroll, revenue, and journal entry.

Work through that against your own system permissions rather than your org chart. Job titles rarely match what people can actually do in the software.

The vendor master rows are the ones we would check first, since they carry the largest exposure in most accounts payable processes.

A fair question here is how much of this the law actually demands.

What does Sarbanes-Oxley require on segregation of duties?

The Act does not prescribe segregation of duties by name. It makes management responsible for internal control over financial reporting, and segregation of duties is one of the standard controls companies use to discharge that responsibility.

That distinction trips people up. There is no line in the statute you can point to and say a specific duty must be split.

Two sections do the work instead, as of August 2026:

• Section 302: requires management, including the principal executive and financial officers, to make quarterly and annual certifications relating to internal control over financial reporting.
• Section 404: requires a company reporting under the Securities Exchange Act to include a report of management on internal control over financial reporting in its annual report.

Section 404(b) goes one step further and requires the external auditor to attest to management's assessment, which is what people mean by the audit of internal control over financial reporting.

Scope is worth knowing before you worry about any of it. The Section 404 reporting requirements do not apply to nonpublic companies, and they also exclude registered investment companies and issuers of asset-backed securities.

So if you are a private company, none of this is a legal obligation. It still tends to arrive through the back door, in customer security questionnaires, lender covenants, and investor diligence.

The framework most companies use to structure the controls themselves is the COSO Internal Control Integrated Framework, which organizes them into five components. If you are preparing for a review, our guide to a compliance audit covers what the process involves. This is general information rather than legal advice.

Which leads to the question every small finance team actually wants answered.

What if your accounting team is too small to segregate duties?

Auditing standards address this directly rather than pretending it away. A smaller, less complex company with fewer people in the accounting function has limited opportunity to separate duties, and it may implement alternative controls instead.

This is the most useful thing to know in the whole topic, and it is missing from most explanations.

PCAOB Auditing Standard 2201, which governs the audit of internal control over financial reporting, recognizes that a smaller company may have too few accounting staff to segregate duties fully, and that it will use alternative controls to meet its control objectives.

The obligation that follows is not on you to hire. It is on the auditor to evaluate whether those alternative controls are actually effective.

The standard also contemplates the auditor testing entity-level controls instead of the process controls that a segregation gap would otherwise undermine.

Read that carefully and two practical conclusions follow.

1. A segregation gap is not automatically a failure: what fails is an undocumented gap with nothing put in its place.
2. The alternative control has to be real: a review nobody evidences will not survive testing, so it needs a date, a reviewer, and a record.

That second point is where most small teams come unstuck. Documentation, not intent, is what gets tested.

End-to-end management of PF, ESI, PT, TDS, and other mandatory filings, with audit-ready documentation and reports.

Wisemonk, India payroll services, 2026

Payroll is a useful example, because it is one process where outsourcing the run to a third party creates genuine separation as a side effect. The same logic applies when you move monitoring to a separate compliance monitoring team.

There is a point where stacking compensating controls costs more than the separation would have. Every one needs designing, evidencing, and testing each year, and they slow the close down.

One additional person who owns reconciliation independently can retire three compensating controls at once. That trade is worth pricing rather than assuming.

Until you get to that point, these are the controls auditors most commonly accept.

What compensating controls do auditors accept?

Controls that put an independent pair of eyes somewhere in the chain without adding a full role. The common ones are independent bank reconciliation review, approval thresholds, system access reviews, surprise checks, and rotation of sensitive tasks.

The test for each is whether it would catch the specific thing your gap allows. A generic control mapped to a specific risk is how teams end up with a control that reads well and does nothing.

Six that hold up well in testing:

• Independent review of bank reconciliations: someone outside the process signs and dates the reconciliation, including the owner or a board member in a very small company.
• Approval thresholds: any payment above a set value needs a second approver, which concentrates scarce review time where the exposure is.
• Vendor master change reports: a periodic list of new and amended supplier records, especially bank detail changes, reviewed by someone who cannot edit them.
• System access reviews: a scheduled check of who can do what in the finance system, since permissions drift far faster than job descriptions.
• Rotation of sensitive tasks: moving who performs a task periodically makes a concealed problem much harder to sustain.
• Exception and duplicate reporting: automated flags for duplicate invoices, round-sum payments, and payments to new accounts, reviewed outside the payments team.

Whoever performs these has to be genuinely outside the process, which is the constraint that decides how many you can run. In regulated settings that reviewer is often a dedicated regulatory reporting analyst.

There is one more wrinkle, and it is newer than the framework itself.

How does automation change segregation of duties?

It moves the conflict rather than removing it. A workflow tool or service account that can create a vendor, approve an invoice, and release payment holds the same combination of duties a person would, and it does so at machine speed and volume.

This is the part of the topic that has changed most, and the framework has not caught up in most companies.

Teams spend real effort separating three humans, then grant a single integration account full permissions across all three steps because it was easier during implementation.

The awkward part is accountability. When a person approves something wrongly you can ask them why. When an automated rule does it, the answer sits in a configuration nobody has reviewed since setup.

So the control shifts from who does the task to who may change the rule and who reviews the log, which pulls segregation of duties into the same territory as data security.

Four practical translations of the old controls into an automated process:

The last row is the important one, because a threshold that routes nothing to a human is a control on paper only. We looked at how teams set those routing rules across functions in our guide to agentic offshoring in India.

Automation makes the reviewer role more important, not less, which is the same conclusion we reached on what stays human when you offshore.

All of which comes back to having enough people to put someone genuinely outside the process.

How do you build segregation of duties into a small finance team?

Separate the highest-risk pair first, which is usually payment release from vendor master maintenance, then move reconciliation to an independent owner. Those two changes retire most compensating controls, and they need roughly one additional person rather than a department.

That is the honest answer to the small-team problem. At some point the cheapest control is another pair of hands.

India is a common place to add that capacity, because the qualified-accountant pool is deep and the working day overlaps usefully with both US and UK hours for a reviewer who needs to query things same-day.

There is a structural advantage too, and it is easy to miss: a reviewer employed in a different location and reporting line is more independent of the process than one sitting next to it. Our guide to an offshore finance and accounting team covers how those reporting lines get set up.

The roles that create real separation, in the order most teams add them:

1. Reconciliation accountant: owns bank and balance sheet reconciliations independently of whoever posts the entries.
2. Accounts payable controller: handles vendor master data and invoice validation, with no payment release rights.
3. Controls or compliance analyst: runs access reviews, exception reports, and the evidence file your auditor will ask for.
4. Internal audit or assurance lead: tests the controls periodically once the process set is large enough to need it.

Most companies stop after the first two and are in far better shape than they were. Our breakdown of the cost of an offshore finance team in India shows what each of those roles adds.

One caution if you are tempted to use contractors for a control role. Classification matters, and an independent contractor performing a core, ongoing control function invites a reclassification argument.

We score each role against India's control, integration, and economic-dependence tests. Every engagement carries a written classification memo your auditor can rely on.
Wisemonk, Contractor of Record in India, 2026

For an ongoing control owner, employment is usually the cleaner route, and our comparison of EOR vs entity in India sets out the two ways to get there.

If an audit date is driving your timeline, our hiring timeline in India breaks down how long each stage takes in practice.

Regulated businesses often build controls staffing alongside offshore legal compliance and KYC operations, since both need the same independence from the front office.

For the wider background on why this work sits in India at all, see our overview of India outsourcing.

If this would be your first hire there, our step-by-step guide to building an offshore team in India is the place to start.

And for the strategic case rather than the mechanics, read our guide to offshoring to India.

How can Wisemonk help you build a finance controls team in India?

Wisemonk is an India-native Employer of Record (EOR) that helps global companies hire, pay, and manage talent in India without setting up a local entity.

For a controls problem, that means you can put an independent reconciliation accountant or controls analyst in place within weeks, on a compliant Indian employment contract, without registering a company in India first.

We support 300+ global clients and more than 2,000 employees across India, process $20M+ in annual payroll, and hold a 4.8/5 rating on G2. Pricing starts from $99 per employee per month as of August 2026.

Here is how we help:

• Recruitment: we source and screen qualified accountants for reconciliation, payables control, and compliance roles.
• Managed payroll: we run payroll and statutory filings with audit-ready documentation, which separates the payroll run from your own team by design.
• Background checks: controls staff get privileged system access, so we verify identity, credentials, and history before day one.
• Contractor management: where a project reviewer genuinely is a contractor, we contract and pay them with a written classification position.
• GCC setup: when controls grow into a wider shared services or assurance function, we help you build it out.
• Entity setup: if the team reaches the scale where your own Indian entity makes sense, we support that transition.

From our experience helping companies build finance teams in India, the fastest way to close a segregation gap is to move reconciliation out first, because it is the one control an auditor always tests.