Auditing a small client that cannot segregate duties
How to audit a small client where one person authorises, records and holds assets: owner oversight, substantive evidence and what to report.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
The client has one bookkeeper. She raises the invoices, banks the takings, pays the suppliers, runs the payroll and reconciles the bank account. The owner approves payments on the banking app when she asks. Every textbook control weakness is present, and none of them will be fixed by a management letter, because the business cannot afford a second clerk.
The audit has to work with the business as it is. That means understanding which risks the missing segregation creates, testing whatever oversight the owner really provides, and putting the weight of the evidence where those risks sit.
Why small entities cannot segregate
AccountingTools states that no single person should control authorisation, recordkeeping and custody of assets for the same transaction. It also acknowledges that segregation of duties is harder to achieve in a smaller organisation with too few people, and that spreading tasks across too many people can slow processing. Its guide to segregation of duties explains the principle and the practical trade-offs.
ACCA describes the related idea of internal check: arranging accounting procedures so that no one person has absolute and independent control, with each person's work complementing another's every day. With one bookkeeper there is nobody whose work complements hers. That is the starting fact of the audit, not a finding to be discovered at the end.
Owner oversight as a compensating control
In many small businesses the owner is the control. The owner reads the bank statement, approves larger payments, looks over the payroll before it goes out and knows the customers and suppliers by name. Done consistently, that can be effective. Test it like any other control:
- What exactly does the owner review, how often, and what would they notice?
- Is there evidence of the review: initials on statements, approvals in the banking platform, e-mails querying items?
- Can the bookkeeper get around it, for example by releasing payments alone below a limit, or by changing a supplier's bank details without the owner seeing?
There is a catch. Owner oversight limits the bookkeeper's opportunities; it does nothing about the owner's. Where the owner holds every right, the risk becomes management override, and the response to that has to be substantive.
Shifting the weight to substantive evidence
According to ACCA, ISA 330 requires substantive procedures for each material class of transactions, account balance and disclosure, whatever the assessed risk. In a small entity without segregation, the controls usually cannot be relied on to reduce that work, so the approach is largely substantive. That is normal for a small audit, not a failure of it. What matters is that the substantive work is aimed at the specific risks the missing segregation creates: theft hidden by false entries, income that never reached the books, and payments to people who should not receive them.
In practice:
- Bank: obtain the statements from the bank or confirm the balance directly, reperform the reconciliation, and scan the year's payments for unfamiliar payees.
- Income: test completeness from sources the bookkeeper does not control, such as till records, booking systems, delivery notes or contracts.
- Payments: compare payees with supplier and employee records, and look for any payment to an account linked to the bookkeeper.
Payroll and payments carry the highest risk
ACCA states that the common feature that often facilitates payroll frauds is inadequate segregation of duties. When one person adds employees, sets pay rates, processes the payroll and pays it, the classic schemes become easy: a fictitious employee, an inflated rate, a leaver kept on the payroll for a few extra months.
Useful tests include agreeing employees on the payroll to contracts and identity documents, comparing the bank accounts paid with the employee records and looking for any account paid for more than one person, checking leavers' final pay dates against the payroll, and comparing total payroll cost with headcount and pay rates. Supplier payments deserve the same treatment: new suppliers, changed bank details, and any supplier account that matches an employee's.
Recording samples and findings in Achekam
In Achekam, the walkthrough belongs in the Controls & Walkthrough Studio, which saves its work on the server for the chosen engagement. Record who does what, including exactly what the owner reviews, so the absence of segregation and the compensating review are both documented rather than implied.
For testing, Audit Intelligence risk-scores a loaded population, such as the year's payments or payroll, and proposes a sample, which a reviewer who did not prepare the plan approves before it is drawn; each draw can be reproduced from its stored seed. On a small client, populations are often short enough that "all items" or specific items is the sensible method. Exceptions become findings raised from the working paper and later closed or withdrawn, and any correction is recorded as an audit adjustment on the lead schedule line with a reason. The IT environment in small audits covers the system side, including who holds which user rights.
What to say in the management letter
"There is a lack of segregation of duties" tells the owner nothing they did not know. A useful point is specific and practical:
- Describe the combination: for example, the same person can add a supplier, change its bank details and pay it.
- Say what could go wrong in plain words: money paid to an account she controls, without anyone else seeing it.
- Suggest measures within the business's means: the owner reviewing and initialling the bank statement each month, the owner as the only person able to add payees or change bank details on the banking platform, owner approval of every payroll change, and someone else covering the bookkeeper's duties when she takes leave.
- Acknowledge the size of the business, so the recommendation reads as realistic rather than as a template.
Reporting deficiencies in the management letter covers wording and follow-up. A small client cannot buy segregation, but it can usually afford an owner who looks at the right documents every month. The audit's job is to know whether that is happening, and to say so plainly when it is not.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
