Business and Technology · Internal controls

Segregation of Duties, Authorisation and Physical Controls

Updated 11 October 2026 · Fact-checked

Control activities are the day-to-day procedures that stop or catch errors and fraud. The main ones are segregation of duties, authorisation limits, physical security and reconciliations. To answer a scenario question, find the weakness, name the matching control, and explain how it reduces the risk.

Understand Control Activities: Segregation of Duties, Authorisation and Physical Controls

An internal control system is the set of policies and procedures a business uses to protect assets, keep records reliable and follow rules. Control activities are the actual procedures that staff carry out each day. They are the part of the system you can see in a scenario.

Segregation of duties means no single person controls a transaction from start to finish. You split the main tasks: authorising a transaction, recording it, and having custody of the related asset. If one person did all three, they could steal and hide it. With two or more people, theft needs collusion, which is harder and riskier.

Authorisation means a transaction happens only if the right person approves it. Businesses set authorisation limits: a supervisor may approve purchases up to $5,000, and a director must approve anything above. Approval should be evidenced, for example by a signature or a system log.

Physical controls protect assets and records from theft, damage or misuse. Examples are locked stores, safes, restricted access to buildings, CCTV, security tags, and password or badge access to systems. Regular reconciliations compare two sets of records, such as the bank statement and the cash book, so differences are found and investigated.

These controls are mostly preventive (stop the problem) or detective (find it afterwards). Segregation, authorisation and physical controls are mainly preventive. Reconciliations are detective. Remember that controls have limits: collusion, management override and human error can still defeat them, and small firms may lack the staff to segregate fully.

Key formulas to remember

Incompatible duties to separate: Authorisation, Recording, Custody (and often Reconciliation); Aim for different people to perform each. If one person does two or more, point out the risk.
Control answer pattern: Weakness → Risk → Control → How it helps; Use this four-part pattern for every scenario point to earn full marks.
Authorisation rule: Amount ≤ limit: approver at that level; Amount > limit: next level up; Limits should match seniority and be set in writing.
Reconciliation rule: Balance per records ± reconciling items = balance per external source; Done regularly and reviewed by someone independent of the person who keeps the records.
Control types: Preventive = before; Detective = after; Corrective = fix; Segregation, authorisation and physical controls are mainly preventive.

How to solve Control Activities: Segregation of Duties, Authorisation and Physical Controls questions

Use this method for any scenario or objective test question about control activities.

1Read the scenario and underline who does what. List each person's tasks.
2Check whether one person both handles an asset (custody) and records it, or both approves and processes. That is a segregation weakness.
3Look for transactions with no evidence of approval, or approvals above someone's authority. That is an authorisation weakness.
4Look for assets or records that anyone can reach, such as open stores, shared passwords or unlocked cash. That is a physical control weakness.
5Check for missing reconciliations or independent reviews.
6Match each weakness to one specific control and state the risk it addresses, for example fraud, error or loss.
7For multiple response questions, pick only the options that directly fix the stated weakness and count your selections against the number asked.

Quickest way: The three-question scan

When to use it: Use this on objective test questions when you have about two to three minutes at most.

Ask: can one person start, record and handle the asset? If yes, answer segregation of duties.
Ask: was approval missing or beyond a limit? If yes, answer authorisation.
Ask: can unauthorised people reach the asset or records? If yes, answer physical or access control.
Eliminate options that describe a different type of control, such as detective ones when the question asks for preventive.

Common mistakes in Control Activities: Segregation of Duties, Authorisation and Physical Controls

Saying segregation of duties means different people do different jobs in general.
The phrase sounds like ordinary division of labour.
Fix: Define it as separating authorisation, recording and custody for the same transaction so fraud needs collusion.
Recommending segregation in a very small business without caveats.
Students apply the textbook rule without checking staff numbers.
Fix: Suggest alternatives such as owner review, rotation of duties and independent checking of reconciliations.
Listing controls without linking them to the weakness in the scenario.
Students recall a list and write it down.
Fix: Quote the weakness, state the risk, then give the control. Use the scenario facts.
Confusing authorisation with authentication or with approval after the event.
The terms sound alike.
Fix: Authorisation is approval before the transaction proceeds, by someone with the right authority.
Treating reconciliations as preventive controls.
Students see them as a control and assume they stop errors.
Fix: A reconciliation finds differences after they happen, so it is detective.
Claiming a control removes fraud entirely.
Students overstate the benefit.
Fix: Say the control reduces risk. Collusion and management override can still defeat it.

Worked examples

Example 1

A small company's cashier receives cheques from customers, records them in the sales ledger, banks them and also prepares the bank reconciliation. Identify the control weakness and recommend two improvements.

Show the solution

Identify the tasks: receiving cash (custody), recording (recording) and reconciling (checking). One person does all.
State the risk: the cashier could take a cheque, record a false credit or delay recording, and hide it in the reconciliation. Fraud or errors may not be noticed.
Improvement 1: separate the duties, so one person opens the post and lists receipts, another records them in the ledger, and a third banks them.
Improvement 2: have someone independent of cash handling prepare the bank reconciliation, with a manager reviewing and signing it each month.
Add that the list of receipts from opening the post should be compared with the bank paying-in slips.

Answer: The weakness is no segregation of custody, recording and reconciliation, which allows theft to be concealed. Separate receiving, recording and banking among different staff, and have an independent person prepare and a manager review the bank reconciliation.

Example 2

Which ONE of the following is an example of an authorisation control? A: A safe with restricted key access. B: Purchase orders above $10,000 require a director's signature. C: A monthly bank reconciliation. D: The person who records sales does not handle cash.

Show the solution

Option A restricts access to cash, so it is a physical control.
Option B requires approval from someone with the right authority above a set limit, which is an authorisation control.
Option C compares two sets of records after the event, so it is a reconciliation (detective) control.
Option D separates recording from custody, so it is segregation of duties.

Answer: B

Exam tips

In scenario questions, name the specific person and task in your answer, such as the stores clerk who also updates the inventory records.
Always give the risk as well as the control. A control with no stated purpose often earns half marks.
For multiple response questions, read the number of answers required and tick exactly that many.
In number-free control questions, watch for words like preventive, detective and mainly. They decide between close options.
In a small-business scenario, mention compensating controls such as owner supervision when full segregation is not possible.

Practice questions from Internal controls

Control Activities: Segregation of Duties, Authorisation and Physical Controls: frequently asked questions

What are examples of segregation of duties?

Common examples are that the person who orders goods does not approve the supplier invoice for payment. The person who handles cash does not record it. The person who prepares payroll does not authorise new employees or pay rises.

What is the difference between authorisation and segregation of duties?

Authorisation means a transaction needs approval from someone with the right authority. Segregation of duties means different people handle the approving, recording and custody stages. Both aim to prevent fraud and error, but they work differently.

What are physical controls in accounting?

They are measures that protect assets and records from theft, damage or unauthorised access. Examples include locked stores, safes, CCTV, security passes and restricted access to computer rooms and systems.

How do I answer internal control scenario questions in ACCA BT?

Find the weakness in the scenario, state the risk it creates, then recommend a specific control and explain how it helps. Use the facts given rather than a general list. Keep each point short and separate.