Segregation of duties when an agent posts journals

Segregation of duties still applies when an agent prepares and posts journals. The agent that drafts a journal must not also be the party that approves it, and posting without an independent check is acceptable only for routine journals inside proven bounds. Two agents built on the same configuration, or one agent in two roles, do not make a separation.

What does segregation of duties protect against?

Segregation of duties splits a process so that no single party can both make an error, or commit a fraud, and conceal it. In journal processing, the classic split is between preparing an entry, approving it and posting it, with reconciliation of the results done by someone else again.

The control protects against two things. The first is error: a second person reviewing an entry catches mistakes the preparer missed. The second is deliberate misstatement: someone who can both prepare and approve a journal could move money or manipulate results without anyone noticing.

Agents change who does the work. They do not change why the split matters.

Does an agent count as a separate party?

Not in the way a person does, and this is the central point. Separation works because two people have different knowledge, different incentives and separate accountability. A reviewer is unlikely to share the preparer's blind spots and has their own reasons to catch an error.

An agent reviewing its own draft has none of that independence. It shares its own blind spots completely. Two agents built from the same brief, reading the same sources and running on the same model are not much better: they are likely to make the same mistake and agree with each other about it.

So the rule is simple. An agent can prepare. An independent party must check. For most journals, that party is a person. For a narrow set of routine journals, it can be an independent control: a bound enforced at the moment of action plus a sample review by a person afterwards.

How should duties be split?

A segregation of duties matrix for finance agents sets out each duty and who may perform it. An illustrative version:

The last row is often missed. Whoever can change the agent's brief, sources or limits can change what it posts. That is itself a duty that should be separated from posting and approval.

When can an agent post without approval of each journal?

When three conditions all hold. The journal type is routine and rule-based, such as monthly depreciation from the fixed asset register. The agent has earned depth 3 for that type through certification on the firm's own past journals, after a period of drafting, as argued in finance agents should draft journals before they post them. And the firm's limits bound what it may post: amounts, accounts, periods, and the requirement that the source data come from a sealed system of record.

Even then, the check has not disappeared; it has moved. Instead of a person approving each journal before posting, the bounds check each journal at the moment of action, and a person reviews a sample afterwards. If the sample shows problems, the agent's depth for that journal type is reconsidered.

The practical setup for this is covered in how to let an AI agent post journals in your general ledger. For everything outside the routine set, the approach in how to review manual journals before they are posted with an AI agent applies.

What about the people who configure the agent?

They hold a powerful position. An engineer or finance systems administrator who can change an agent's brief, add an account to its permitted list, or raise its posting limit can influence every journal the agent produces. In a traditional process, that would be like someone who could rewrite the preparer's instructions and also approve the results.

Configuration changes should therefore go through change control: requested by one person, approved by another, recorded, and ideally followed by a targeted certification run to confirm the change did what was intended. The person who approves configuration changes should not also approve the agent's journals.

How do you show auditors the separation is real?

With records. For every journal the agent touched, the verdict record should show what the agent did, whether the journal was held or allowed, which bound decided, and who approved or reviewed it. For configuration, the change log should show who requested and who approved each change.

Auditors testing segregation of duties will sample journals and check that preparer and approver differ. With agents, they will also want to see that the agent was not able to approve its own work, that routine postings stayed within bounds, and that sample reviews happened. If all of that is in the record, the test is quick. If it is not, expect a finding.

What should you do differently?

Draw your segregation of duties matrix with agents as explicit rows, not hidden inside the "system" line. Make sure no agent can approve its own drafts, and that configuration changes sit with someone outside the posting process. Where agents post routine journals, write down the bounds and the sample review that replace pre-approval. Keeping duties separate in this way is part of AI agents for finance: books you can audit.