Segregation of duties and approval

Segregation of duties is one of the oldest controls in finance. The idea is simple: one person does not hold the whole flow of a transaction. The person who records a vendor bill is not the person who approves its payment, and the approver is not the person who executes the transfer. Whoever reconciles the bank statement should not be the person who holds bank access. That way a single mistake or a single bad intention has to pass more than one pair of eyes before money leaves.

In a small organisation, full segregation is often impossible because there are few people. But the principle can still be kept: the owner or manager approves payments prepared by staff, or someone outside finance reviews the reconciliation each month.

So where does AI stand? AI is a preparer, never an approver or an executor. AI may draft adjusting entries from your notes, group bills by due date, or write explanations of differences. But AI has no name, cannot be held accountable, and can be wrong with no warning sign. Putting AI in the approver's seat is the same as removing one pair of eyes from a flow designed precisely to have several.

From that comes a firm rule for this track: AI never posts a journal entry or runs a payment without review and approval by a person whose name is recorded. The rule holds whatever the tool, including features in accounting systems that offer "create entries automatically" or "schedule payments". What is allowed is AI producing a draft that goes into a queue; posting or paying is done by the person who opens that draft, compares it with the source documents, and approves it.

There are three temptations to recognise. First, volume: with hundreds of small transactions, approving one by one feels slow. The answer is not to remove approval but to approve in batches with a list that can be checked. Second, similarity: this month's transactions resemble last month's, so repeating them automatically feels safe. Yet payment fraud often disguises itself as a routine bill with the destination account changed. Third, trust in the tool: AI output that is usually right makes people stop reading. A wider explanation of when something must not be automated is in the when not to automate lesson.

This is what human in the loop means in finance. An approval that is not recorded is the same as none. For each draft entry or payment prepared with AI help, keep a simple audit trail: who prepared it, that it was AI-assisted, which source documents were matched, who approved it and when. This trail helps at audit time, when a difference appears next month, and when a newcomer asks why an entry was made. The principle of people deciding is explained more generally in the people decide lesson.