Should organisations use compensating controls when AR headcount is small?

Why compensating controls are acceptable only as a stopgap

Compensating controls are a practical response when a small AR team cannot fully separate duties without stopping the work. They are acceptable only if they are temporary, explicitly approved, and designed to narrow exposure rather than pretend the underlying segregation issue is solved. The control objective is still to remove incompatible task combinations as soon as staffing or role design allows.

In practice, the best compensating controls are the ones that add friction, visibility, and independent challenge to the exact step that cannot yet be separated. That usually means one person initiates, another approves, and a third periodically reviews patterns for abuse or error. When a workaround becomes the normal operating model, it stops being a compensation control and becomes a structural weakness.

For teams formalising SoD exceptions, the Segregation of Duties (SoD) Guide is the most direct internal reference for conflict rules, mitigations, and compensating controls across access governance.

What compensating controls need to cover in a small team

The core issue is not simply headcount, it is whether one person can both create and conceal a harmful outcome. If that is possible, the compensating control must break the path to silent failure. Supervisor sign-off helps, but only when the approver has enough context to challenge the request, not merely rubber-stamp it.

Rotating duties can reduce familiarity risk and make abuse harder to sustain, but rotation only works when the role actually changes hands and the reviewer is independent enough to notice anomalies. Independent review is strongest when it checks both the transaction and the pattern behind it, such as repeated exceptions, unusual timing, or the same person appearing in every approval chain.

This is why compensating controls should be matched to the specific SoD conflict, not applied generically. A finance posting conflict, a master-data change conflict, and an access-grant conflict each fail differently, so the temporary control must target the exact point where concentration of authority creates risk.

Authoritative control catalogs still matter here because they define the control intent even when the staffing model is imperfect. NIST SP 800-53 Rev 5 Security and Privacy Controls and CIS Controls v8 both reinforce the need for access restriction, auditability, and controlled account management when one role cannot fully self-segregate.

When a compensating control is no longer good enough

The main failure mode is permanence. If the organisation keeps the exception open indefinitely, the compensating layer becomes an excuse for bad design instead of a bridge to a safer operating model. That is especially dangerous when the same small team also owns approvals, execution, and review, because the control chain then depends on the honesty and consistency of one group.

Another failure mode is overtrust in management review. A supervisor can approve a task, but approval does not restore true separation if the approver is also dependent on the same person for delivery, reporting, or explanation. The risk is not only deliberate fraud, but also error propagation, because a single person can carry a mistaken assumption through every step without interruption.

For organisations using broader governance or cloud control baselines, ISO/IEC 27001:2022 Information Security Management and the CSA Cloud Controls Matrix provide useful reference points for documenting exceptions, preserving accountability, and keeping compensating measures tied to formal control ownership.

Practitioner Guidance

What to prioritise: Treat the exception register as temporary change management, not as a standing operating model. If the same compensating control appears across multiple processes, the real issue is probably role design, not just staffing scarcity.

What to verify: Confirm that approvals are genuinely independent, that reviewers can see the evidence they need, and that the person performing the work cannot also close the audit trail without challenge. If that is not true, the control is mostly ceremonial.

Decision rule: If the task can affect cash movement, access grants, master data, or other high-impact records, require a defined expiry date for the exception and a named plan to eliminate the SoD conflict. If no remediation path exists, escalate the issue as a control deficiency rather than continuing the workaround.

Practitioner takeaway: Compensating controls are acceptable only when they reduce blast radius while the organisation corrects the underlying role structure, and the moment they become routine, they have failed their purpose.

Related resources from NHI Mgmt Group

• What breaks when organisations let USB use continue without compensating controls?
• When should organisations use compensating controls instead of immediate separation?
• Should small finance teams use compensating controls when full AP segregation is not possible?
• How do organisations operationalise NHI ownership at scale?