Payment-Approval Limits for a Two-Person Finance Team: A Practical Disbursement Matrix

Your bookkeeper creates the vendor, enters the invoice, approves the payment, and reconciles the bank account. Everything balances. And that is exactly the problem: when one person controls a disbursement from start to finish, your books will balance right up until the day you discover they should not have.

Here is the uncomfortable math. Organizations lose an estimated 5% of revenue to occupational fraud every year, the median case costs around $145,000, and it runs for about 12 months before anyone notices. Small organizations get hit harder than almost anyone: businesses with fewer than 100 employees suffer a median fraud loss of about $141,000 — the second-highest of any size group — precisely because they run with fewer controls. Billing schemes and check or payment tampering dominate at small shops, and investigators cite missing internal controls as the primary weakness in roughly a third of all cases.

You cannot hire your way out of this with a two-person finance team. But you do not need to. What you need is a written payment-approval matrix: a one-page chart that says who can create, approve, release, and reconcile each kind of disbursement, at what dollar limit, and what happens when a payment exceeds it. This guide gives you that matrix, the limits to put in it, and the compensating controls that cover what two people cannot segregate.

Why Two-Person Teams Are the Highest-Risk Shape​

Textbook internal control assumes a finance department: one person orders, another receives, a third approves, a fourth pays, a fifth reconciles. A two-person team — say, an owner and a bookkeeper, or a bookkeeper and an office manager — cannot do that. One person will always wear several hats, and some hat combinations are dangerous:

• Creating vendors + approving invoices lets someone invent a supplier and pay it.
• Approving payments + releasing payments lets someone authorize and execute their own disbursement.
• Releasing payments + reconciling the bank account lets someone pay and then hide the payment.

This is not a hypothetical failure mode. The classic small-business fraud is a trusted long-timer — often the only person who "knows the books" — running payments to a look-alike vendor or padding reimbursements for years. The scheme survives because nobody else ever looks at the full cycle. Segregation of duties is not an all-or-nothing concept: you separate what you can, then cover the gaps with oversight controls. The matrix below is how you decide which is which.

The Four Hats: Create, Approve, Release, Reconcile​

Every disbursement passes through four roles. Name them explicitly, because "the bookkeeper handles payables" hides the fact that one human is doing all four:

• Create. Entering the invoice or reimbursement, setting up the vendor, keying the bill into the accounting system. This is data entry with consequences: whatever is created here becomes a liability you will pay.
• Approve. Saying yes — confirming the goods or services were received, the price and quantity match, the expense is legitimate and budgeted, and the documentation is complete. Approval is a decision, not a rubber stamp.
• Release. Actually moving the money: signing the check, clicking "pay" in bill pay, submitting the ACH batch, sending the wire. Release is custody of the asset.
• Reconcile. Independently verifying after the fact: matching the bank statement to the books, tying the payables ledger to the control account, reviewing who was paid and flagging anything odd.

The incompatibility rule is simple: no one person should hold all four hats for the same payment, and the two pairs that must never combine are approve-plus-release and release-plus-reconcile. If your bookkeeper releases payments, someone else reconciles the bank account. If your office manager approves invoices, someone else clicks pay. Everything else in this guide is an application of that sentence.

The Matrix: Who Does What, at What Limit​

Build this as an actual table — a spreadsheet or a page in your procedures manual — with one row per transaction type. Roles, not names: write "Bookkeeper" and "Owner" so the policy survives turnover. Here is a starting model for a typical two-person shop:

You will notice one deliberate overlap: the bookkeeper both approves and releases small recurring bills. That is the exception that proves the rule, and it survives only because the variance trigger and the monthly owner review surround it — remove either, and the exception has to go. Treat the dollar amounts as examples to calibrate, not universal recommendations. A $1,000 routine limit fits a business spending $40,000 a month; scale yours so the owner reviews roughly the top 10–20% of payments by value. The structural points are the ones to keep: unbudgeted spending and policy exceptions get a $0 limit (they always escalate), vendor-master changes always need the owner, and the person who reconciles never releases.

Two details make or break the limits. First, define the limit against the total commitment, not the first payment: a $400-a-month, 24-month contract is a $9,600 decision and must escalate as one. Second, write the escalation as a pair — who it goes to plus the exact trigger ("owner, when over $1,000 or outside budget") — so nobody has to exercise judgment about whether judgment is required.

The Control Everyone Skips: The Vendor Master​

Most small businesses guard the check-signing and leave the vendor list wide open. That is backwards. A fictitious vendor is the load-bearing wall of billing-scheme fraud: once a fake supplier exists in the system with attacker-controlled payment details, every invoice after it looks legitimate.

Lock the vendor master with four rules:

1. Only the owner (or the non-AP person) approves new vendors and changes. The person who enters invoices must not be able to add payees or edit bank details unchallenged.
2. Verify independently before the first payment. Call the vendor at a publicly listed number — not the number on the invoice or in the change-request email — to confirm remit-to addresses and account numbers. This one callback defeats both fictitious vendors and business-email-compromise rerouting.
3. Require a W-9 before setup for US service vendors. It forces a real name, address, and taxpayer ID into the file, which is both a compliance step and a fraud filter: fake vendors fail paperwork.
4. Review and purge quarterly. Deactivate vendors with no activity in 12 months, merge duplicates, and scan for look-alikes ("Acme Corp" vs. "Acme Corp." vs. "Acme Consulting"). Dormant and duplicate records are where ghost invoices hide.

Three-Way Matching, Small-Team Edition​

Enterprise AP matches every invoice three ways — purchase order, receiving record, invoice — before paying. You can run a lighter version without a purchasing department:

• For goods: the invoice must match a packing slip, delivery photo, or receiving email confirming what arrived, plus an approval that the price and quantity are right.
• For services: the invoice must match a deliverable, milestone sign-off, or time summary, plus an approval from whoever received the work.
• For recurring bills: skip the match, but enforce the variance rule — anything that moved more than ~10% from last month escalates for a look before it pays.

Stamp or flag invoices as paid in the system the moment they are released, and never pay from a copy or a forwarded email thread when the original invoice is missing. Duplicate payments are the most common unforced error in small AP shops, and "pay only from the original, marked paid" prevents most of them.

Reconciliation: Your Detective Backstop​

Preventive controls (approvals, limits) stop bad payments. Detective controls catch the ones that slip through — and in a two-person team, detection carries extra weight because prevention can never be airtight. Assign reconciliation to whoever does not release payments, and make it genuinely independent:

• Bank reconciliation by the non-releaser, reviewed by the owner. If the bookkeeper pays the bills, the owner (or an outside bookkeeper) reconciles the bank account and actually reads the statement — payees, amounts, endorsements — rather than just tying the balance.
• Read-only bank access for the reviewer. Most banks offer view-only logins and read-only statement access. The reviewer should be able to see everything and move nothing.
• Positive pay if your bank offers it. You transmit a list of issued checks or ACH originations; the bank rejects anything not on the list. It is the single most effective check-fraud control available to small businesses, and many banks include basic positive pay free with business checking.
• A monthly owner review with teeth. Fifteen minutes, every month: the payables aging, the new-vendor log, refunds issued, and any payment over the routine limit. Initial and date it. A review nobody documents is a review that stops happening.

Compensating Controls for What You Cannot Segregate​

Some overlaps are unavoidable with two people. Each one gets a named compensating control:

• Mandatory cross-training and vacation coverage. Every critical function must be performable by the other person — and once a year, it should be, while the primary is fully offline for at least a week. Schemes that require daily concealment surface fast when the concealer is on a beach. If "only Pat can run payroll" is true in your shop, that sentence is your risk register.
• Surprise spot-checks. Quarterly, the owner pulls five random paid invoices and traces each from original invoice through approval to bank debit. Unpredictability is the control: a scheduled review gets gamed; a random one cannot be prepared for.
• Dual authorization on wires and new payees. Configure the bank so wires above a threshold — or to any first-time payee — require two distinct logins to release. This is a bank-side control, so it holds even when your internal process wobbles.
• System-enforced roles, not honor-system roles. If your accounting software supports approval workflows and permission levels, turn them on: the bookkeeper enters and the owner approves inside the system, with an audit trail neither can edit. A matrix on paper plus admin rights for everyone is decoration.
• An outside eye once a year. A CPA or contract controller who reviews the books annually, rotates which months they examine, and reports to the owner — not to the bookkeeper — is the cheapest segregation money can buy.

Five Mistakes That Gut the Whole Matrix​

1. Rubber-stamp approvals. An owner who approves every invoice in a Friday batch without reading them has a signature, not a control. If volume makes real review impossible, raise the routine limit and review fewer payments properly instead of many superficially.
2. Limits that exist only on paper. If the bookkeeper can exceed the limit in the accounting system and at the bank without friction, the limit is a suggestion. Enforce it in permissions, bill-pay roles, and bank transfer caps.
3. One person holding the bank token and the books. Whoever can move money at the bank must not be the only person recording the movement. Split the token from the ledger, always.
4. Approving your own spending. Founders are the worst offenders: owner expenses, owner reimbursements, and owner draws with no second look. Co-owner, spouse-partner, or CPA review keeps the top of the matrix honest.
5. Ignoring small recurring charges. Fraud test-drives at small amounts, and subscription creep bleeds real money. The quarterly vendor review and the 10%-variance rule exist for the $49 charges, not the $49,000 ones.

Your 30-Day Implementation Checklist​

• Week 1: List every payment type you make and draft the matrix with current reality in each cell. The gaps you find are the project plan.
• Week 2: Set tiered limits, the $0 unbudgeted rule, and escalation pairs. Configure software permissions and bank dual-control to match.
• Week 3: Clean the vendor master (deactivate dormant, merge duplicates), collect missing W-9s, and verify bank details for your top ten payees by callback.
• Week 4: Run the first monthly owner review, schedule quarterly spot-checks for the year, and file the signed matrix where both people can find it.

Start enforcing on day one of month two. A control with a "we'll start soon" date is a control that never starts.

Keep Every Dollar Accounted For​

A payment-approval matrix only works if the records underneath it are complete and trustworthy — every approval tied to a real invoice, every release tied to a bank movement, every reconciliation traceable months later. That means disciplined bookkeeping: timely entry, clean payables aging, and an audit trail you can actually follow. If you want your financial records in a format that is transparent, version-controlled, and easy to review line by line, Beancount.io offers plain-text accounting that puts every transaction in a readable file you own. Get started for free and give your two-person team the clear ledger its new controls deserve. For a visual monthly review, pair it with the Fava dashboard to scan spending by account before you sign off.