🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Business & Cross-Cutting › Bookkeeping / Office Administration › Accounts Receivable and Accounts Payable › Lesson 5
BUS-BOOK55-04 · Lesson 5 · 10 clock hours · theory

Internal Controls, Separation of Duties, and Office Safety in AR/AP

Objective. Students identify at least five internal controls specific to AR/AP operations and explain how separation of duties, authorization limits, and document retention reduce fraud risk and support workplace safety.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by a credentialed professional in the field or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Internal Controls Matter in AR/AP

Every dollar that flows into or out of a business passes through accounts receivable (AR) and accounts payable (AP). That makes these two cycles prime targets for fraud, error, and misuse. Internal controls are the policies, procedures, and structural safeguards an organization puts in place to protect assets, ensure accurate records, and comply with laws. Without them, a single dishonest or careless employee can cause serious financial harm before anyone notices.

The most widely accepted framework for designing and evaluating internal controls is the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control — Integrated Framework. COSO organizes control activity around five components: Control Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities. In a bookkeeping role, you will most often work within the Control Activities component, which includes the day-to-day procedures that prevent and detect problems.

Five Key Internal Controls for AR and AP

1. Separation of Duties

No single employee should control all steps of a financial transaction. In AR, the person who opens the mail and lists incoming checks should not be the same person who posts payments to customer accounts or makes the bank deposit. In AP, the employee who enters vendor invoices should not also approve payments or sign checks. When duties are separated, one person's work acts as an automatic check on another's.

2. Authorization Limits

Every payment or credit adjustment should require approval, and the level of approval should match the dollar amount. A bookkeeper may be authorized to approve routine invoices up to a set threshold; anything above that threshold requires a supervisor or manager signature. This tiered authorization makes it harder for anyone to push through large or fraudulent transactions unnoticed.

3. Document Retention and the Audit Trail

Original source documents — purchase orders, vendor invoices, receiving reports, remittance advices, and bank deposit slips — must be retained for the period required by law and company policy. Matching these documents at each step (a process called a three-way match in AP: purchase order, receiving report, and invoice) creates a paper trail that supports every entry in the books and deters falsification.

4. Physical Controls Over Cash and Negotiable Instruments

Checks, petty cash, blank check stock, and incoming mail payments must be stored in locked drawers or a safe when not in active use. Access to those areas should be limited to authorized personnel only. Visitor access to areas where cash or checks are handled must be controlled — a simple sign-in log and an escorted-visitor policy are practical starting points.

5. Reconciliation and Independent Review

Bank accounts should be reconciled monthly by someone who does not also record cash receipts or issue payments. Customer AR sub-ledger balances should be reconciled to the general ledger control account regularly. Vendor AP balances should be reviewed for duplicate invoices and unusual credits. Independent review catches posting errors and deters manipulation.

Additional controls worth noting: prenumbered documents (so missing numbers are visible), mandatory vacation policies (which force another employee to cover duties and may expose ongoing fraud), and regular internal audits all reinforce the five controls above.

Separation of Duties: A Responsibility Matrix

A responsibility matrix maps each task in the AR or AP cycle to the staff role that should — and should not — perform it. For example:

When two incompatible functions land with the same person — for example, a single employee both approves invoices and issues payment — a control gap exists. Small businesses with limited staff must compensate with stronger owner oversight and more frequent independent reviews.

Office Safety in the AR/AP Environment

Bookkeeping and office administration may seem low-risk, but OSHA's General Industry standards (29 CFR 1910) apply to office workplaces. Three areas are especially relevant:

Ergonomics and Workstation Design (General Duty Clause / OSHA ergonomics guidance): Employees who enter data for extended periods risk musculoskeletal strain. Adjustable chairs, monitor positioning at eye level, wrist rests, and scheduled breaks reduce injury. While OSHA does not currently have a specific ergonomics standard for general industry, employers have a General Duty Clause obligation to provide a workplace free of recognized hazards.

Emergency Egress (29 CFR 1910.37): Exit routes must be kept clear at all times. Filing cabinets, supply boxes, and office furniture must never block corridors, stairwells, or exit doors. Employees should know the location of all exits and the office emergency evacuation plan.

Electrical Safety at Workstations (29 CFR 1910.303 and related sections): Power strips must not be daisy-chained. Cords should be routed away from foot-traffic areas to prevent tripping hazards and damage. Equipment that sparks, smells of burning, or has damaged cords should be reported and taken out of service immediately.

Beyond OSHA compliance, the secure handling of sensitive financial documents directly protects both the business and its clients. Cross-cut shredding of documents containing account numbers, Social Security numbers, or vendor banking details before disposal is a control requirement as well as a privacy best practice under regulations such as the FTC Safeguards Rule.

Key terms10

Internal ControlsPolicies, procedures, and structural safeguards designed to protect assets, ensure accurate financial records, and prevent or detect fraud and error.
COSO FrameworkThe Committee of Sponsoring Organizations of the Treadway Commission Internal Control — Integrated Framework; a widely accepted model for designing and evaluating internal controls within organizations.
Separation of DutiesA control principle requiring that no single employee controls all steps of a financial transaction; different people handle authorization, recordkeeping, and custody of assets.
Authorization LimitA defined dollar threshold up to which a specific employee or role may approve transactions without seeking higher-level approval.
Three-Way MatchAn AP control procedure that compares the purchase order, the receiving report, and the vendor invoice before approving payment to verify that goods or services were ordered, received, and billed correctly.
Audit TrailThe chain of original source documents and journal entries that allows any recorded transaction to be traced from first authorization through final posting and payment.
Responsibility MatrixA chart that maps each task in a financial process to the employee role authorized to perform it, making incompatible function assignments visible.
Incompatible FunctionsTwo or more duties that, when held by the same person, remove a key check on that person's work and increase fraud or error risk — for example, both approving and recording a payment.
General Duty ClauseSection 5(a)(1) of the Occupational Safety and Health Act; requires employers to provide a workplace free from recognized hazards likely to cause death or serious physical harm, even when no specific standard exists.
Document RetentionThe practice of keeping original financial records for legally required and company-specified periods so that transactions can be audited and verified at a later date.
In class: Lecture and case study: review of Committee of Sponsoring Organizations (COSO) internal control framework applied to AR/AP; students read a one-page scenario of a fictitious billing fraud and identify which controls were missing · Discussion and mapping exercise: students complete a responsibility matrix showing which staff roles (cashier, bookkeeper, supervisor) should perform each step of the AR and AP cycles, identifying incompatible functions · Safety walkthrough discussion: proper handling of checks and cash in the office environment (locked drawers, visitor access controls, shredding sensitive documents); students list three OSHA General Industry standards relevant to office environments and explain how they apply (e.g., ergonomics, emergency egress, electrical safety for workstations)
Materials: COSO internal control overview handout, fraud case study printout, responsibility matrix template, OSHA General Industry standards summary (29 CFR 1910 overview), AIPB reference (internal controls section)
Check: Completed responsibility matrix and a written list of five controls with one-sentence justification each; pass = matrix contains no incompatible function assignments and all five controls are correctly described

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

AIPB Certified Bookkeeper — Internal Controls
1. Which COSO component most directly addresses the day-to-day procedures a bookkeeper follows to prevent fraud in AR/AP?
AIPB Certified Bookkeeper — Internal Controls
2. A small office has only one bookkeeper who opens the mail, posts incoming payments to the AR ledger, and also prepares the bank deposit. Which internal control principle is being violated?
AIPB Certified Bookkeeper — Accounts Payable
3. In a three-way match for accounts payable, which three documents are compared before a payment is approved?
AIPB Certified Bookkeeper — Internal Controls
4. A supervisor must sign any vendor payment exceeding a certain dollar threshold, while the bookkeeper approves smaller routine invoices independently. This practice describes which internal control?
Office Safety — OSHA General Industry
5. Which of the following OSHA standards most directly applies to keeping office exit corridors clear of filing boxes and furniture?
Office Safety — OSHA General Industry
6. An accounts payable clerk discovers that a power strip in the AP workstation area has a damaged cord and is daisy-chained to a second power strip. What is the correct immediate action?
AIPB Certified Bookkeeper — Internal Controls
7. A fictitious billing scheme is discovered at a company. The fraud was possible because the same employee both created new vendor records in the AP system and approved invoice payments. Which responsibility matrix finding would have flagged this risk in advance?
AIPB Certified Bookkeeper — Internal Controls
8. Which document-handling practice best protects sensitive AR/AP information — such as customer account numbers and vendor banking details — when paper records are no longer needed?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →