Rendani warns on segregation of duties
- Rendani’s warning landed as 2026 audit research showed internal audit teams taking on more second-line work just as finance functions stay lean. - The clearest datapoint is 32% — that’s the share of internal audit leaders reporting at least some second-line involvement. - That matters because weak duty splits in small teams make fake vendors, hidden payments, and trust-based workarounds much easier.
Finance controls sound boring — until one person can set up a vendor, approve a payment, post the entry, and reconcile the account. Then it stops being an accounting-process issue and turns into a fraud pathway. That is the point behind the recent Rendani thread on segregation of duties: in lean teams, “we trust each other” often becomes the control system. At the same time, new Internal Audit Foundation research shows internal audit leaders are being pulled closer to second-line work, which makes the control design question more urgent, not less. (theiia.org) ### What is segregation of duties, exactly? It’s the basic rule that no single person should control a transaction from start to finish. In practice, the risky chain is some version of initiate, approve, record, and reconcile. If one employee can(theiia.org) a set of built-in checkpoints. (sikich.com) ### Why do lean finance teams struggle with it? Because headcount reality collides with control theory. A small company may have one controller, one bookkeeper, and maybe an owner who signs things when asked. On paper, duties are split. In the workflow, the same person still prepares the payment fi(sikich.com)rs, duplicate payments, and off-book adjustments can live. (bakertilly.com) ### Why is trust such a weak control? Because trust doesn’t leave evidence. A real control leaves a trail — approval logs, access restrictions, exception reports, independent reconciliations. Personal familiarity does the opposite. It lowers skepticism, speeds up overrides, and normalizes “just this once” access. Fraud schemes usuall(bakertilly.com)ked reach for too long. (securends.com) ### What changed this year? The backdrop is resource pressure across internal audit and risk functions. The Internal Audit Foundation’s March 2026 research says teams are being asked to do more with limited budgets and staff. Separate IIA-backed research from March also says roughly 32% of internal audit leaders now have at lea(securends.com)and compliance. Basically, the lines are getting blurrier while the workload gets heavier. (prnewswire.com) ### Why does second-line involvement matter here? Because it can help or hurt. The upside is tighter coordination — audit, risk, compliance, and finance can spot control gaps faster. The catch is independence. Internal audit is supposed (prnewswire.com) grading their own homework. (theiia.org) ### So what do companies do if they’re too small? They use compensating controls. That means tighter approval thresholds, owner review of bank activity, locked-down vendor changes, mandatory vacation coverage, exception reporting, and system acce(theiia.org)trust alone. (sikich.com) ### Where does this bite first? Usually in cash disbursements and vendor management. Those are the easiest places for one person to create a believable story and move money before anyone notices. Payroll, journal entries, and reconciliations come next. The pattern is simple — wherever one person can both create the record and explain the record, the control environment is already weaker than management thinks. (bakertilly.com) ### Bottom line Rendani’s warning matters because it points at a very old problem that keeps getting repackaged as a staffing issue. It isn’t just staffing. It’s design. In 2026, with audit leaders stretched and second-line roles expanding, the companies that stay safest will be the ones that make fraud harder at the process level — before trust, speed, or convenience get a vote. (theiia.org)
