What are the fraud risks when an accountant acts as both receivables manager and payables manager?

Why separating receivables and payables matters

The fraud problem here is not just “too much trust”, it is a broken control design. When one accountant can create, approve, post, and reconcile both incoming and outgoing cash activity, they can manufacture offsets that make theft look like normal timing differences, write-offs, or supplier corrections. That concentration also weakens the chance of an independent person spotting a pattern early.

In practice, the same person can use one side of the ledger to hide abuse on the other. A fraudulent credit note, a duplicate payment, or a customer receipt that is never posted to the right account becomes easier to conceal when no second set of eyes owns one of the matching processes. The risk is highest where corrections are informal, reconciliations are delayed, or exceptions are approved by the same role.

For teams that want a control lens on this problem, Fraud Prevention Guide for Digital Businesses is useful because it connects fraud signals, review queues, and control friction to practical loss reduction.

How fraud is usually concealed in this setup

The common abuse patterns are predictable. A rogue accountant may suppress customer receipts, redirect refunds, create bogus suppliers, alter bank details, or push duplicate payments and then cover the trail with manual journals. They may also exploit timing gaps by moving value between receivables and payables periods so that missing cash looks like an unresolved reconciliation item rather than theft.

These schemes work best where master data changes are weakly governed. If supplier, customer, and bank-account edits can be approved, posted, and reconciled by the same person, the fraud path stays inside one workflow. That is why independent review of master data changes matters as much as approval of the payment itself, because the compromise often starts before the money moves.

Controls should therefore treat this as a ledger-integrity and cash-diversion issue, not only an accounting convenience problem. Segregation of duties, exception review, and periodic rotation of duties each reduce a different part of the abuse path.

What to change in controls and monitoring

The first fix is structural: split initiation, approval, posting, and reconciliation across different people or teams wherever feasible. Then make the person who manages receivables unable to approve payables corrections, and vice versa. If full segregation is not possible in a small team, compensate with more frequent independent review and tighter system permissions, especially on master data and journal entry functions.

Monitoring should focus on transactions that are easy to disguise as routine housekeeping. That includes manual journals near period-end, unusual credit notes, round-dollar refunds, supplier changes followed by payments, and repeated use of the same override or exception path. Reconciliations are most effective when they are timely and when unexplained items are escalated, not parked indefinitely.

The underlying control question is whether any single person can both create a payment opportunity and eliminate the evidence of that payment from another control point. If the answer is yes, the process still has a material fraud gap.

Risk and Threat Considerations

Concentrating receivables and payables in one role creates both opportunity and concealment risk. The person can move value out of the business while also controlling the records that should reveal the loss, which means the fraud can persist longer and scale further before detection.

Failure mechanism: The same individual can alter source data, post or suppress entries, and reconcile the accounts, so the control environment loses the independent contradiction that usually exposes theft, fake invoices, duplicate payments, or diverted receipts.

Impact: Losses can accumulate across multiple payment cycles, financial reporting can be distorted, and the organisation may miss warning signs until an audit, bank reconciliation break, or supplier complaint surfaces the problem.

Practitioner Guidance

What to verify: Confirm that no one person can both set up vendor or customer master data and approve or reconcile related cash movements. If that is unavoidable, require documented compensating controls, including review of master-data changes and a separate sign-off on exceptions.

What to prioritise: Focus first on the highest-blast-radius permissions, bank-detail changes, manual payments, credit notes, and write-offs. Those are the points most likely to be used to hide a misappropriation rather than merely to create an accounting error.

Decision rule: If a role can touch both sides of the cash cycle, treat it as a fraud-enabling role until independent approvals and reconciliations prove otherwise. If the business is too small to separate duties fully, increase review frequency and shorten the time between transaction and reconciliation.

Practitioner takeaway: The key question is not whether the accountant is trusted, it is whether the process still forces a second person to contradict them at the exact points where fraud would otherwise disappear into the ledger.

Related resources from NHI Mgmt Group

• How should security teams handle risks from AI browser extensions?
• Why do misleading consent statements present significant risks?
• How should organizations manage browser extension risks?
• Why do state-issued IDs create different fraud risks across jurisdictions?