20 January 2026
Who can change the posting rule in a three-person finance team
Segregation of duties advice written for banks does not fit a company where the same person closes the books and calls the vendor.
We are often asked to ‘implement SoD’ as if it were a switch. In a three-person Malaysian finance team, the accounts executive, the accountant, and the finance manager already cover for each other during leave. A rigid matrix that forbids the accountant from touching suppliers will simply be bypassed with a shared password.
The useful question is narrower: who can edit a posting rule without a second pair of eyes, and how would anyone know? If the audit log is only available on a paid tier, say so in the board pack. If the vendor admin login sits in a personal email, say that too.
A compensating control we see working is a monthly export of rule changes, filed with the bank reconciliation, initialled by someone who did not make the changes. It is paper. It is also something an external auditor can sample.
Automation does not remove the need for that initial. It just moves the initial from the journal voucher to the rule that creates a hundred journals.