Property Management

Segregation of Duties in Property Management, by Portfolio Size

Mehak - Product Strategist, RIOO October 9, 2026

Segregation of duties in property management means no single person controls every step of a transaction. The four duties to keep apart are:

authorizing a transaction
having custody of the money or assets
recording it
reconciling or reviewing it

How far a team can split them depends on its size. Small teams split what they can and cover the rest with compensating controls. Larger teams can split more of them, and need to review access regularly.

For example: a growing management company has one person who sets up new vendors, enters their invoices, releases the payments and reconciles the bank account. She's careful, trusted and fast. Nobody has ever checked her work, because nobody has ever needed to.

That's not a problem with the person. It's a problem with the design. If one person can both make a mistake and keep it from being noticed, the company is relying on hope.

What does segregation of duties actually mean?

The U.S. GAO's Standards for Internal Control describe it as separating the responsibilities for authorizing transactions, processing and recording them, reviewing them, and handling any related assets, so that no one individual controls all key aspects of a transaction. The aim is to prevent fraud, waste and abuse, including management override. The standards are a federal framework, not a requirement for private companies, but private companies can use them as a reference.

In property management, the pairs that matter most are specific:

Keep apart	Why
Setting up vendors, and approving or paying their invoices	Helps prevent payments to vendors who don't exist
Collecting rent and deposits, and recording or reconciling them	Helps prevent receipts from going missing unnoticed
Issuing tenant credits or write-offs, and collecting from tenants	Helps prevent balances being "adjusted" to hide missing money
Approving owner distributions, and releasing them	Helps prevent unauthorized payouts from owner funds
Posting journal entries, and approving them	Helps prevent unreviewed changes to the books
Administering system access, and doing the finance work	Helps prevent people granting themselves permissions

Trust accounts raise the stakes further. RIOO's guide to managing a property management trust account recommends splitting duties for deposits, approvals and reconciliations, specifically to reduce risk.

The four duties, by team size

This is the framework: the same four duties, split differently as the finance team grows. As a portfolio grows, its finance team usually grows with it, so team size is the practical measure. The team sizes below are illustrations, not standards.

Team	What you can usually split	What to cover with compensating controls
Small: two or three finance people	Recording apart from reconciling, and approval of payments apart from releasing them	Almost everything else. See the controls below.
Mid-size: separate AP, AR and accounting roles, with a controller	All four duties for vendor payments and receipts, plus approval of journal entries	Overlaps when someone is away, and system access
Large: multiple entities, departments and approval tiers	All four duties across the key processes, with approval limits by amount and entity	Periodic access reviews, so roles don't quietly accumulate permissions

Small teams: split what you can, cover the rest

With two or three people, full separation isn't possible. The goal is that no single person can make and hide an error alone. Two splits matter most:

The person who records transactions doesn't reconcile the bank account. If that's impossible in-house, use an outside accountant for reconciliations.
The person who approves payments doesn't release them.

Then add compensating controls, which are reviews that catch what separation can't prevent:

The owner or CFO reviews bank statements directly, every month.
Payments above a set amount need two approvals.
Changes to vendor details, especially bank account details, are reviewed by someone else before the next payment.
A report of tenant credits and write-offs is reviewed monthly by someone who didn't issue them.

Mid-size teams: split properly, then watch the gaps

Once AP, AR and accounting are separate roles, all four duties can be split for the main processes. The risks move to the edges:

Cover for absences. When someone is out, does their backup end up holding two incompatible duties? Plan cover so they don't.
Journal entries. Every manual entry should be approved by someone other than the person who posted it.
System access. The person who administers the system shouldn't also process transactions.

Large teams: keep it from drifting

At scale, segregation of duties is usually designed in. The risk is drift: people change roles and keep their old permissions, and temporary access becomes permanent. Review user access on a schedule, and set approval limits by amount, entity and transaction type.

What happens when the team changes?

Segregation of duties is most fragile during change: a resignation, a merger, a new system, a busy close. Each of these is a moment to check whether one person has ended up holding two incompatible duties. RIOO's guide to what finance leaders do when a controller resigns mid-close covers keeping duties separated through a departure.

Who owns each step?

Step	Usually owned by	Done when
Map who holds which duty	Controller	Every process shows who authorizes, holds custody, records and reconciles
Fix incompatible combinations	Controller, with the CFO	Duties reassigned, or a compensating control put in place
Document compensating controls	Controller	Each control has an owner, a frequency and evidence
Review system access	System administrator, with the controller	Access reviewed on schedule, with changes recorded
Approve the design	CFO	Signed off, and reviewed when the team changes

What should leadership watch?

Three things, at least once a year and whenever the team changes:

The duty map. For each finance process, is any one person holding two incompatible duties?
Compensating controls. Are they actually happening, with evidence, or only written down?
Access drift. Do people's system permissions still match their current roles?

And one control question: for each finance process, can you name who authorizes, who holds custody, who records and who reconciles, and show that no single person holds two of them without a compensating control? If the answer for any process is "the same person, and nobody checks," that's where to start.

Where RIOO fits

RIOO is property management software built directly on NetSuite.

Role-based access. RIOO uses role-based access controls to limit what each employee can do, reducing the risk of internal collusion.
Approvals with sign-off. RIOO's Finance & Accounting system enforces role-based approvals, so no payment goes through without the right sign-off, and it keeps audit logs of transactions.

Note: This blog is general guidance on internal controls, not audit, legal or accounting advice. Your auditors, lenders, owners and state trust account rules may set specific requirements. Last reviewed October 2026.

Frequently asked questions

Q1. What is segregation of duties in property management?
Separating the duties of authorizing transactions, holding custody of money, recording transactions and reconciling them, so no single person controls a transaction from start to finish.

Q2. What are the four duties that should be separated?
Authorization, custody of assets, recording, and reconciliation or review.

Q3. How can a small property management team segregate duties?
Split the most important pairs, such as recording versus reconciling, and approving versus releasing payments. Then add compensating controls, such as owner review of bank statements, dual approval above a set amount, and review of vendor bank detail changes.

Q4. What is a compensating control?
A review or check that reduces the risk when duties can't be fully separated. For example, an owner reviewing bank statements every month when the bookkeeper also handles payments.

Q5. Which duties are most important to separate in property management?
Vendor setup versus payment, rent collection versus recording and reconciliation, tenant credits versus collections, owner distribution approval versus release, and journal entry posting versus approval.

Q6. Does segregation of duties matter for trust accounts?
Yes, especially. Splitting duties for deposits, approvals and reconciliations reduces the risk of mishandling client funds, and state trust account rules may set their own requirements.

Q7. How often should segregation of duties be reviewed?
At least annually, and whenever the team changes through a hire, a departure, a merger or a new system.

Q8. How does software help with segregation of duties?
Role-based access limits what each person can do in the system, and approval workflows require sign-off from someone other than the person entering the transaction. Software supports the controls, but someone still has to design and review them.