What if there is only one person in finance?

Then your reviewer is outside finance. A founder reviewing the cash reconciliation against a bank balance they can see themselves is a real control, and an outside accountant reviewing entries monthly is a stronger one. What does not work is recording the same person as preparer and reviewer, because it removes the only signal anyone has that a second look happened.

Can the CEO be the reviewer?

For cash and payroll, yes, and often they are the best available choice because they know what the business did. For technical accounting they are not, and asking them to approve a revenue cutoff judgment they cannot evaluate teaches everyone that review is a formality.

Does our outsourced bookkeeper count as separation?

Only if someone inside reviews their work. An outsourced preparer with no internal reviewer has the same problem as an internal preparer with no reviewer, moved one company over. The common failure is assuming the bookkeeper reviews themselves.

What threshold should trigger a review on journal entries?

Pick one number and hold it rather than debating each entry. Many companies at this size use something near a quarter of their monthly materiality, which usually lands between $5,000 and $25,000. All manual entries in the last two days of the close get reviewed regardless of size, because that is where the pressure is.

How much of this does an auditor actually test?

For a first audit, often less than you expect, because they may decide not to rely on controls at all. What they always do is ask what your process is and then check whether the evidence matches the description. A process you describe accurately, even a thin one, holds up better than an aspirational one.

Is a checkmark in a spreadsheet enough documentation?

It is better than nothing and weaker than it looks, because it records that someone ticked a box and not who or when. The useful minimum is the reviewer name, the date, and what they compared. Anything that lets a stranger a year later reconstruct the review is enough.

Guide

Preparer and reviewer when finance is three people: segregation of duties without pretending

Segregation of duties means the person who prepares something is not the person who approves it. At a company with three people in finance you cannot separate everything, and pretending otherwise produces a control that exists on paper and nowhere else. The workable version is to separate the few steps where a single person could both cause an error and hide it, which in practice means cash, payroll, journal entries above a threshold, and anything touching a bank login. For everything else, a named reviewer who actually looks, even a non-accountant founder or an outside CPA, beats an unnamed reviewer who was assumed.

By Vanward. Published 2026-09-19. Updated 2026-09-19.

Every small finance team has the same conversation eventually. Someone reads that duties must be segregated, looks around a room containing a controller, a staff accountant and a part-time bookkeeper, and concludes the rule was written for somebody else. It was not. It was written loosely enough to scale down, and scaling it down honestly is the work.

Separate the steps where one person could both err and conceal

That pairing is the whole test. A mistake somebody else will see anyway does not need a second signature. A mistake the same person could quietly correct out of view does.

Step	Needs a separate reviewer	Why
Bank and cash reconciliation	Always	The preparer can move money and reconcile it. Nothing else in the close has that property
Payroll register to ledger	Always	Largest recurring cash outflow and the easiest to alter without anyone noticing
Manual journal entries over the threshold	Always	A manual entry is the tool used to hide everything else
AP and disbursements	Always, and split approval from payment if you can	The vendor a preparer can both create and pay is the classic loss
Accrual calculations	Yes where judgment is involved	A reviewer catches the assumption, not the arithmetic
Revenue recognition judgments	Yes, and the reviewer should be qualified	This is the one place a non-accountant reviewer adds little
Prepaid and fixed asset schedules	Periodically, not monthly	Mechanical, slow moving, low concealment value
Intercompany eliminations	Yes if you have more than one entity	Errors here net to zero at the top and hide inside the entities

Who the reviewer can be

Someone else in finance

Best when available. A staff accountant reviewing the controller is unusual on paper and works fine in practice, because the review is a comparison against source documents rather than a judgment of seniority.

The founder or CEO

Legitimate for cash, payroll and disbursements, where the question is whether the numbers match the business they run. Give them the comparison, not the workpaper: here is the bank balance, here is the ledger, here is the list of what is outstanding.

Your outside CPA

The right answer for technical judgments, and worth the hours. A monthly review call where someone qualified looks at the entries and the accruals is a genuine control and usually cheaper than the audit hours it prevents.

Nobody, documented as nobody

Sometimes this is the truth for a step, and writing that down is better than assigning a reviewer who does not review. An auditor finding an honest gap adjusts their approach. An auditor finding a signature from someone who cannot explain what they signed has a bigger problem to worry about.

What to record

Four things, and they fit in a line: who prepared it, who reviewed it, when, and what the reviewer compared. The fourth is the one people skip and the one that makes the record worth anything a year later.

Keep it attached to the step rather than in a separate log. A review recorded somewhere else becomes an orphan the moment the person who maintained the log leaves, and that is exactly when someone asks.

The failure worth naming

The most common one at this size is not fraud. It is the close that runs three days late every month, so the reviewer starts approving in batches on the last afternoon without opening the workpapers. The control still looks intact in the record and has stopped functioning entirely.

If your reviewer approves everything in one sitting, the schedule is the problem rather than the person. Move the review to the step, the day the step finishes, and the batch disappears.

Questions founders ask

What if there is only one person in finance?: Then your reviewer is outside finance. A founder reviewing the cash reconciliation against a bank balance they can see themselves is a real control, and an outside accountant reviewing entries monthly is a stronger one. What does not work is recording the same person as preparer and reviewer, because it removes the only signal anyone has that a second look happened.
Can the CEO be the reviewer?: For cash and payroll, yes, and often they are the best available choice because they know what the business did. For technical accounting they are not, and asking them to approve a revenue cutoff judgment they cannot evaluate teaches everyone that review is a formality.
Does our outsourced bookkeeper count as separation?: Only if someone inside reviews their work. An outsourced preparer with no internal reviewer has the same problem as an internal preparer with no reviewer, moved one company over. The common failure is assuming the bookkeeper reviews themselves.
What threshold should trigger a review on journal entries?: Pick one number and hold it rather than debating each entry. Many companies at this size use something near a quarter of their monthly materiality, which usually lands between $5,000 and $25,000. All manual entries in the last two days of the close get reviewed regardless of size, because that is where the pressure is.
How much of this does an auditor actually test?: For a first audit, often less than you expect, because they may decide not to rely on controls at all. What they always do is ask what your process is and then check whether the evidence matches the description. A process you describe accurately, even a thin one, holds up better than an aspirational one.
Is a checkmark in a spreadsheet enough documentation?: It is better than nothing and weaker than it looks, because it records that someone ticked a box and not who or when. The useful minimum is the reviewer name, the date, and what they compared. Anything that lets a stranger a year later reconstruct the review is enough.

How ready is your close?

Eight yes-or-no questions, two minutes, no account. You get a score out of 100 and the three gaps most likely to come up in an audit or a diligence request.

Take the free close check