Treasury Roles and Segregation of Duties

Why This Topic Matters

Treasury is the part of the organization that touches cash directly. It moves money between bank accounts, releases wire transfers, invests surplus funds, borrows, trades foreign exchange and manages bank relationships. Because treasury staff have the ability to move large sums very quickly, the function is a natural target for both internal fraud and external attack (for example business email compromise). A clear structure of roles, combined with strong segregation of duties, is the primary defence against misappropriation, error and reputational damage.

For the CTP exam this topic sits within Corporate Liquidity Management and the broader treasury operations and controls material. It is examined frequently because it links to many other areas: payment systems, bank account management, internal controls under Sarbanes-Oxley, the COSO framework, fraud prevention and treasury technology. Candidates who understand the logic behind who does what, and why, can answer a wide range of questions even when the scenario is unfamiliar.

What It Is: The Treasury Organization and Its Roles

Position of treasury in the finance organization
Treasury normally reports to the Chief Financial Officer (CFO). The CFO typically has two principal direct reports on the finance side: the Treasurer and the Controller. Separating these two roles is itself a fundamental control.

Treasurer: responsible for managing the company's financial assets and liabilities. Core responsibilities include cash and liquidity management, cash forecasting, short-term investing and borrowing, capital structure and long-term funding, bank relationship management, financial risk management (interest rate, FX, commodity), payment execution and often insurance and pension asset management.

Controller: responsible for recording and reporting. Core responsibilities include general ledger accounting, financial statement preparation, accounts payable and receivable processing, payroll, tax compliance, budgeting and the design and monitoring of internal controls. The controller function typically performs bank account reconciliations precisely because it does not initiate or approve cash movements.

Keeping custody and movement of cash (treasury) separate from the recording of cash (controller/accounting) is the single most important organizational segregation in corporate finance.

Typical roles within the treasury department
Treasurer: sets policy, oversees the function, holds ultimate accountability and usually approves the largest transactions.
Assistant Treasurer: manages daily operations, often supervises the cash manager and risk or capital markets staff, and serves as a second approver.
Cash Manager: determines the daily cash position, concentrates funds, decides short-term investing or borrowing, initiates funding transfers and manages bank account structures.
Treasury Analyst: gathers bank balance data, prepares the cash position worksheet, performs forecasting, enters transactions into the treasury management system (TMS), and supports reporting.
Treasury Operations or Back Office staff: confirm trades, settle transactions, release payments after approval and manage documentation.
Risk Manager: identifies, measures and hedges financial exposures within policy limits.
Bank Relationship Manager: handles service agreements, fee analysis, account openings and closings and signatory maintenance.

Front, middle and back office
Larger treasuries, especially those with trading activity, adopt a three-way structure borrowed from financial institutions:
Front office: makes decisions and executes transactions (dealing, investing, borrowing, hedging).
Middle office: independently monitors risk, checks compliance with policy limits, values positions and reports exposures. It must be independent of the front office.
Back office: confirms transactions with counterparties, settles them, records them and reconciles. It must be independent of the front office as well.
The point of this structure is that the person who decides to do a deal never confirms, settles or accounts for that same deal.

What Segregation of Duties Means

Segregation of duties (SoD), sometimes called separation of duties, is the control principle that no single individual should have control over all phases of a transaction. Classic control theory divides a transaction into four incompatible functions:
1. Authorization: approving the transaction (for example approving a wire or a new vendor).
2. Custody: having access to the asset (for example the ability to release payments or hold investment securities).
3. Recording: entering the transaction into the accounting records.
4. Reconciliation or verification: comparing records to independent evidence such as bank statements.

If one person performs two or more of these for the same transaction, that person can both commit and conceal an error or fraud. Segregation of duties removes that opportunity, which is one of the three elements of the fraud triangle (opportunity, pressure and rationalization). It also increases the chance that honest errors are caught because a second person sees each transaction.

Segregation of duties versus dual control
These terms are related but distinct and the exam may test the difference. Segregation of duties assigns different stages of a process to different people. Dual control (also called the four-eyes principle) requires two people to act together to complete a single step, such as two approvers for a wire above a threshold or two keys to open a vault. Dual control is often used as a reinforcement within a segregated process.

How It Works in Practice

Payment processing
A well-controlled payment flow separates at least three roles: the person who initiates or creates the payment, the person who approves it (verifying against supporting documentation), and the person or system step that releases it to the bank. Approval authority is tiered by dollar amount, with larger payments requiring a more senior approver or two approvers. Payment templates and repetitive wire instructions are set up and changed under separate approval so that someone cannot quietly alter a beneficiary account number. Changes to vendor master data are approved outside of the payment initiation team and are confirmed through a call-back to a known contact, not to a number provided in the change request.

Bank account management
Opening or closing a bank account requires board or treasurer-level authorization documented in a resolution. Authorized signatories are reviewed periodically and removed promptly when staff leave. Bank statements and electronic reporting should be delivered to the reconciliation function, not solely to the people who move the money. Bank reconciliations are prepared by accounting staff who have no transaction initiation or approval rights, and reviewed by a supervisor.

Investing and borrowing
The cash manager or dealer decides and executes within policy limits (front office). Confirmations from counterparties go to the back office, which matches them to the deal ticket. Settlement instructions are maintained under separate control. Accounting records the trade and reconciles positions to custodian statements. Middle office checks counterparty limits, maturity limits and instrument eligibility and reports breaches.

System access controls
In a treasury management system or bank portal, segregation is enforced through user roles, entitlements and workflow. Key design points are: no user has both initiate and approve rights for the same payment type; administrators who set up users cannot themselves transact; limits are hard-coded; approval workflows cannot be bypassed; and audit logs record every action with user ID and timestamp. Periodic user access reviews confirm that entitlements still match job responsibilities. Multi-factor authentication and tokens protect each individual's credentials so that one person cannot act under another's identity.

Supporting controls
Segregation is reinforced by other preventive and detective controls: written treasury policies and procedures, approval limit matrices, daily cash position reviews by a second person, independent confirmation of trades, positive pay and ACH debit blocks, mandatory vacations and job rotation (so that concealed schemes surface when someone else does the job), periodic internal audit reviews, and surprise reviews of bank statements by management.

Small treasury departments and compensating controls
Many companies have a treasury of only two or three people, which makes complete segregation impossible. The exam expects you to know that the answer is compensating controls, not acceptance of the risk. Examples include: having the CFO or controller act as the second approver; routing bank statements directly to someone outside treasury for review; using bank-level dual authorization so the bank itself enforces two approvers; increased management review of exception reports; and internal or external audit testing more frequently. Where a single person must both initiate and approve small payments, a low dollar limit and after-the-fact review by an independent person is a typical compensating control.

Regulatory and framework context
Under Sarbanes-Oxley Section 404, management of US public companies must assess and report on the effectiveness of internal control over financial reporting, and segregation of duties within treasury and cash processes is a core element of that assessment. The COSO Internal Control framework identifies control activities, including segregation of duties, as one of its five components. Audit committees and external auditors routinely focus on cash controls because cash is the asset most susceptible to misappropriation.

How to Answer Exam Questions on This Topic

CTP questions on roles and segregation of duties tend to fall into a few recognizable patterns.

Pattern 1: Identify the violation. You are given a list of duties performed by one person and asked which combination is a control weakness. Apply the four-function test. Any pairing of authorization, custody, recording or reconciliation in one person is a violation. The most common exam combinations are: initiating and approving the same payment; approving payments and reconciling the bank account; maintaining vendor master data and initiating payments; executing investments and confirming or settling them; and having system administration rights plus transaction rights.

Pattern 2: Who should perform this task? For reconciliations, the answer is someone independent of cash movement, usually accounting or the controller's staff. For trade confirmation, it is the back office, not the dealer. For risk limit monitoring, it is the middle office or an independent risk function, not the front office. For approving a new bank account, it is senior management or the board through a resolution, not the cash manager alone.

Pattern 3: Treasurer versus controller. If a responsibility involves moving, investing, borrowing or protecting cash and financial risk, it belongs to the treasurer. If it involves recording, reporting, tax, payables processing or control monitoring, it belongs to the controller. When a question asks why the two are separated, the answer is to separate custody of assets from the recording of those assets.

Pattern 4: Small department scenarios. When the stem says the company has a very small treasury staff, look for the answer that introduces a compensating control such as management review, bank-enforced dual authorization, or an independent reviewer, rather than an answer that simply accepts the weakness or spends unrealistically on new staff.

Pattern 5: Technology and access. Questions about TMS or bank portal setup usually want the answer that enforces segregation through system roles and workflow, prevents the same user from initiating and approving, restricts administrator rights, and provides an audit trail.

Exam Tips: Answering Questions on Treasury Roles and Segregation of Duties

1. Memorize the four incompatible functions: authorization, custody, recording and reconciliation. Almost every SoD question can be solved by asking whether one person holds two of these.

2. Think in terms of commit and conceal. If the duties described would allow one person both to take cash and to hide it in the records, it is a violation. If not, it may be acceptable even if it looks unusual.

3. Bank reconciliation is the classic trap. The correct performer is always someone who neither initiates nor approves cash transactions. If an answer places reconciliation with the cash manager or the person who releases wires, eliminate it.

4. Know the treasurer and controller split cold. Treasurer equals cash, funding, investments, banking, financial risk. Controller equals accounting, reporting, tax, payables, payroll, internal control oversight.

5. Front, middle and back office must be independent of each other. The dealer never confirms, settles, values or records the trade.

6. Distinguish segregation of duties from dual control. Segregation splits tasks among people; dual control requires two people for a single task. If a question describes two approvers on one wire, that is dual control.

7. In small company scenarios choose compensating controls. The best answer adds independent review or bank-enforced controls rather than tolerating the exposure.

8. Prefer preventive over detective controls when asked for the strongest control, but remember detective controls such as reconciliations and audit log review are still essential and are often the correct answer when the question is about discovering a problem.

9. Watch for the most senior person doing everything. Questions sometimes imply that because the treasurer is trusted or senior, concentration of duties is fine. It is not. Seniority does not substitute for segregation.

10. Read for the word independent. Answer choices that include an independent reviewer, independent confirmation or independent reconciliation are frequently correct because independence is the essence of segregation.

11. Link to related topics. Be ready to connect SoD to Sarbanes-Oxley 404, the COSO framework, the fraud triangle, payment fraud prevention (positive pay, call-backs on beneficiary changes) and treasury system access controls. Exam items often combine two of these.

12. Eliminate extreme answers. Choices that say a single person may perform all steps for efficiency, or that controls are unnecessary because the bank provides them, are almost always wrong.

Key Takeaways

Treasury has custody of the organization's most liquid asset, so its structure must be designed around control. The treasurer manages cash, funding, investments and financial risk; the controller records, reports and reconciles. Within treasury, front, middle and back office functions remain independent. No individual should authorize, hold, record and reconcile the same transaction, and where staff size makes this impossible, compensating controls such as independent review and bank-enforced dual authorization fill the gap. On the exam, test each scenario against the four incompatible functions, keep reconciliation with accounting, keep the dealer away from settlement, and favor answers that add independence and system-enforced controls.