This is one reason that taking vacations may be considered an internal control. Separation of duties will only limit the possibility of problems arising due to incompatible duties. Collusion can occur, invalidating the control procedures in place. There is a risk involved when one person has a thorough knowledge and understanding of the total system and when they have access to the entire computer system. Therefore caution should be exercised in selecting individuals and areas for cross training.
Separation of duties is more difficult to achieve in a centralized, computerized environment.
Segregation of duties is also a critical issue in a computer center, but that specialized area is not here. In a small operation, management may need to take a more active role to achieve separation of duties. In one case there was a lack of separation of duties, whereby employees could initiate disbursements and had either direct access to the warrants or could access them indirectly through their update capability of the vendor file. Lack of proper separation of duties resulted in an employee converting Incidental Revenue funds into personal use. An employee misappropriated funds for personal use, due in part to incompatible duties and lack of independent verifications.