How do I achieve segregation of duties with a small finance team?

The portfolio that satisfies most auditors: the owner or CFO reviews and releases every payment run (or every run above a floor), seeing payee, amount, and supporting invoice - not just a total; dual authorization at the bank for payments above a threshold; someone outside AP - even the CEO - receiving and scanning the unopened bank statement or its digital equivalent monthly; an independent review of vendor master changes (new vendors, banking edits) on a monthly cadence; and mandatory vacation or duty rotation so concealment requires continuous presence. Each is cheap in hours; together they cover entry-to-payment risk without new headcount. Document who performs each, how often, and what they'd do on an exception - that documentation is what converts "the owner keeps an eye on things" into a control an auditor can test.

Substantially, yes. A system that enforces role separation gives a three-person team separations that used to require five: the same person physically can't approve an invoice they entered, payment approval is a distinct permission, vendor changes route to someone else, and every action is attributed and logged. Technology also upgrades the detective side - exception reports and anomaly flags replace manual log review. What it can't replace is independent judgment: someone outside the process still has to look at what the system reports.

Split the highest-risk piece you can (typically: the second person, or the owner, approves what the first enters), add owner-level payment release review, and document both. Auditors don't expect a 2-person team to look like an enterprise - they expect the conflict to be acknowledged and compensated, not waved off.

Three things, monthly or per-run: the payment run before release (payees, amounts, anything unfamiliar), new vendors and banking-detail changes, and the bank statement against expectations. That's a few hours a month covering the major fraud paths.

Take the bank reconciliation away first - the person moving money must not be the person checking the bank. Then add owner payment release and a vendor-change review. Those three moves break the conceal-your-own-work loop that makes the all-in-one role dangerous.

Formalize in stages: at ~5, enforce the cash separations and owner review; at ~10 - 15, adopt a documented SoD matrix and role-based system permissions; by the time audit or investor scrutiny arrives, add periodic access reviews and tested compensating controls. The trigger isn't headcount - it's the first external party who will test you.

Per control: the risk it addresses, who performs it, frequency, what they examine, what triggers escalation, and the evidence it leaves (sign-off, log entry, reviewed report). Auditors accept compensating controls they can test; they reject vibes.

Generally acceptable if the controller doesn't also enter invoices or maintain vendors, and their backup approvals are visible (logged as such, reviewable). It becomes a problem when "backup" turns into routine and the controller is approving spend they later review in reconciliation - watch the volume.

There's no bright line, but tolerance fades fast once a finance team can support basic separation - roughly when you have three or more finance staff, or when transaction volume makes owner review impractical. What auditors never accept at any size: unacknowledged conflicts with no compensating control.

Stampli lets small teams run separations as system rules rather than staffing plans: role-based permissions split entry, approval, payment, and admin functions; approval authority limits enforce who can sign at what amount; and invoice approval and payment approval remain distinct gates. The immutable activity record gives the reviewing owner or CFO a complete, attributable history to scan - so the compensating-review controls small companies depend on take minutes instead of evenings.