A fundamental element of internal control is the maintenance of adequate segregation of duties (SoD), the allocation of work so that an individual cannot both perpetrate and conceal errors or fraud in the normal course of their duties. Notwithstanding its importance, there has been limited research describing the conceptual basis for determining how duties should be segregated. Significant differences exist between the SoD model proposed in the theoretical literature, the model described in the pedagogical and practitioner literature and auditing standards, and the practices commonly implemented by organizations. The purpose of this paper is to synthesize a model for SoD that reflects the insights of literature domains and is sufficiently descriptive to be applied effectively in typical business processes. The synthesized model calls for segregation of three sets of tasks: 1) asset custody, valuation and decision-making and recording; 2) primary authorization, recording of primary authorization, reconciliation and recording of reconciliation; and 3) secondary authorization, reconciliation of the record of primary authorization, and authorization of reconciliation. It also differentiates between primary SoDs, which allow detection of errors, and secondary SoDs, which help organizations to maintain a consistent, repeatable level of internal control This is significantly different from both the three-way segregation called for in the theoretical literature and the model described in the pedagogical and practitioner literature and auditing standards. Insight provided by the new model provides an opportunity for organizations to enhance the quality or reduce the cost of internal control in organizations. Several future research opportunities are identified.
