What is segregation of duties in a government contracting context?

Segregation of duties for a government contractor is a control design in which no single person ordinarily controls an entire transaction cycle from initiation to approval and reconciliation. In practice, organizations may separate the person who enters a timesheet from the person who reviews it, the buyer who creates a purchase order from the person who authorizes it, and the preparer who posts a journal entry from the person who reconciles the account it affects. Applicable accounting and purchasing criteria address related control areas, while additional role separation can be a prudent control recommendation; the specific requirements depend on the clause incorporated and the contractor’s procedures. As an independent readiness advisor, Lightbridge ERP can help organizations assess ERP role design against those requirements and risks.

When can a segregation-of-duties gap become a material weakness?

Under current DFARS language, a material weakness is a deficiency or combination of deficiencies in internal control over information in contractor business systems such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. The existence of a role overlap does not automatically meet that definition. The cognizant contracting officer, considering the applicable system criteria and review findings, determines whether the facts support a material weakness; DCAA and other reviewers distinguish material weaknesses from system deficiencies and less-than-material noncompliance. A role or access gap is one area a review may examine, but its classification depends on the facts, materiality, likelihood, and compensating controls.

What may a DCAA timekeeping review examine for segregation of duties?

DCAA evaluates the accounting system against the current DoD class-deviation criteria in DFARS 252.242-7999; legacy contracts may include 252.242-7006. The criteria include a timekeeping system that identifies employees’ labor by intermediate or final cost objectives and a labor distribution system that charges direct and indirect labor to the appropriate cost objectives. DCAA guidance may also assess supervisor review of time charges. A DCAA review may include interviews, process walkthroughs, and floor checks. Floor checks primarily observe or interview employees to verify attendance, work performed, job classification, and the cost objective charged; they are not principally a trace of recorded hours through the approval chain. Approval and post-approval change controls may be examined separately under DCAA guidance and the contractor’s procedures. An administrator’s ability to recode hours after sign-off is a risk to investigate and document, but it is not by itself an automatic material weakness or failure; the outcome depends on the applicable criteria, facts, and controls.

Can the same person post a journal entry and reconcile the account it affects?

The accounting-system clauses require approval and documentation of adjusting entries and reconciliation of subsidiary cost ledgers and cost objectives to the general ledger, but they do not expressly require different people for posting and reconciliation. Assigning those tasks to different roles is a prudent recommended control; smaller teams may need documented compensating controls. This applies whether the entry is a routine correction or a period-end adjustment. As an independent readiness advisor, Lightbridge ERP can help evaluate journal-entry workflows alongside the native approval-routing controls covered in the guide to NetSuite journal entry approval.

What happens if a review identifies a segregation-of-duties deficiency?

The review or audit findings go to the cognizant contracting officer, who makes the applicable system approval, disapproval, and material-weakness determinations. For current DoD class deviations, the relevant clauses are 252.242-7998 for Contractor Business Systems, 252.242-7999 for Accounting System Administration, and 252.244-7998 for Contractor Purchasing System Administration; a legacy contract may still carry 252.242-7005, 252.242-7006, or 252.244-7001. A segregation-of-duties gap is not automatically a material weakness. Withholding under current 252.242-7998 requires a covered contract subject to the Cost Accounting Standards and inclusion of 252.242-7998; inclusion of only an accounting or purchasing clause is insufficient. After a final disapproval and notice to withhold, the current clause generally starts at 5 percent for one system and may reduce directly related withholding to 2 percent when an acceptable corrective-action plan is being effectively implemented. Submission or execution of a plan alone does not end withholding; the contracting officer determines when the material weaknesses are corrected. DCAA generally performs the underlying accounting system review and reports its findings, while DCMA administers the Contractor Purchasing System Review. Verify the incorporated clauses and current process against acquisition.gov and official DCAA and DCMA guidance before relying on a specific figure.

How can ERP configuration support segregation of duties for a government contractor?

ERP role design can support segregation of duties by making recommended separations explicit: a role that can enter or edit a timesheet may be kept separate from timesheet approval, a role that can create a purchase order may be kept separate from approval under the contractor’s authority matrix, and a role that can post a journal entry may be kept separate from reconciliation. These are readiness design examples, not a statement that DFARS requires each exact pairing. This is the same access-control discipline covered in the guide to NetSuite roles and permissions, applied to control points a business-system review may examine. As an independent readiness advisor, Lightbridge ERP can help organizations assess role and workflow design before a review.

SK Written by Sarika Krishnan with Robert LabardeeSenior Program Manager and Founder and CEO

Last updated August 2026.

Segregation of duties for government contractors

For government contractors, segregation of duties is an internal-control design principle that limits one person's control over an entire transaction cycle: recording time, distributing labor, creating a purchase order, or posting a journal entry, then also approving or reconciling that same action. The applicable DFARS business-system criteria and DCAA/DCMA review practices inform how organizations assess these risks; Lightbridge ERP provides independent, vendor-neutral readiness advice.

GovCon ERP practice Talk to an ERP advisor

When a segregation-of-duties gap can become a material weakness under DFARS.

The current DoD business-systems framework identifies six contractor business systems subject to review: accounting, estimating, purchasing, earned value management, material management and accounting, and property management. DFARS 252.234-7002 (or its class-deviation successor 252.234-7999 for new solicitations and contracts) governs the earned value management system. The successor is effective under active Class Deviation 2026-O0011. Current class-deviation clauses use 252.242-7998 for Contractor Business Systems, 252.242-7999 for Accounting System Administration, and 252.244-7998 for Contractor Purchasing System Administration. Legacy contracts may still incorporate 252.242-7005, 252.242-7006, or 252.244-7001, so the clauses actually incorporated in a contract matter. The applicable accounting and purchasing criteria address control areas relevant to segregation of duties, but a role overlap is not automatically a material weakness. DFARS defines a material weakness as a deficiency or combination of deficiencies in internal control over information in contractor business systems such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. The cognizant contracting officer evaluates the facts and makes the determination.

When the cognizant contracting officer makes a final determination that a covered contractor business system is disapproved for material weaknesses, current 252.242-7998 provides for withholding on specified payments, generally 5 percent for one system, subject to applicable limits. An acceptable corrective-action plan that is being effectively implemented can reduce directly related withholding to 2 percent, but submitting or executing a plan does not by itself end withholding; the contracting officer determines when the weaknesses are corrected. For current withholding applicability, the contract must be a covered contract subject to the Cost Accounting Standards and include 252.242-7998; inclusion of only an accounting or purchasing clause is not enough. For the cost-accounting foundation this framework sits on, see the guide to DCAA-compliant accounting.

What the accounting-system criteria address

Under current DoD class deviations, DCAA evaluates the accounting system against DFARS 252.242-7999; legacy contracts may use 252.242-7006. The criteria address a sound internal control environment, accounting framework and organizational structure, timekeeping, labor distribution, reconciliation, and approval and documentation of adjusting entries. A readiness assessment can use them to examine segregation-of-duties risks, but the clause does not prescribe one role model or say that every role overlap is a material weakness.

Control environment and organizational structure

The current DoD class-deviation accounting clause, DFARS 252.242-7999, calls for a sound internal control environment, accounting framework, and organizational structure. Legacy contracts may instead incorporate 252.242-7006. Neither text prescribes a particular segregation-of-duties configuration; separating incompatible functions is a prudent readiness recommendation to assess against the contractor's risks and procedures.

Approval of time charges by an appropriate supervisor

DCAA guidance commonly looks for supervisor review of time charges, and independent approval is a prudent readiness control. The clause does not require every approver to be someone who never entered the time, and limited exceptions may apply. A lead approving work only they witnessed is a risk to evaluate, not an automatic failure.

Timekeeping tied to cost objectives

The accounting-system criterion calls for a timekeeping system that identifies employees’ labor by intermediate or final cost objectives. A prudent readiness review can check whether post-submission changes are controlled and traceable; separate roles for configuring labor rules and posting approved labor are recommendations, not express DFARS requirements.

Labor distribution to the ledger

The accounting-system criterion calls for a labor distribution system that charges direct and indirect labor to the appropriate cost objectives. A readiness review can examine who maintains distribution rules and who posts approved labor, but DFARS does not expressly require separate configuration and posting roles.

Approval and documentation of adjusting entries

The accounting-system clause requires approval and documentation of adjusting entries. A separately named approver, separation from the preparer, and detailed change rationale can be prudent control recommendations, but DFARS does not expressly require that exact role arrangement. A single administrator who can post and approve a correction is a risk to assess in light of materiality, compensating controls, and the contractor’s procedures.

What the purchasing-system criteria address

The legacy, codified purchasing-system references are FAR 44.302, DFARS 244.302, and DFARS 252.244-7001. Under the active FAR overhaul (RFO) for current DoD solicitations and contracts, the corresponding figures are FAR 44.301-2, DFARS 244.301-2(a)(1), and DFARS 252.244-7998. The Defense Contract Management Agency administers the Contractor Purchasing System Review. The Basic-clause criteria include system description, clear authority and responsibility, authorized requisitions, complete transaction history, vendor and price analysis, competition, subcontract surveillance, and internal audits or management reviews. Alternate I is narrower. It retains only three counterfeit-parts-focused criteria. Separate requester, buyer, approver, receiver, or invoice-review roles and a three-way match may be prudent controls based on risk and documented policy, but they are not expressly mandated as distinct DFARS criteria.

Requisition, negotiation, and approval kept apart

The Basic versions of the current DoD class-deviation purchasing clause, DFARS 252.244-7998, and legacy DFARS 252.244-7001 address clear lines of authority and responsibility, authorized requisitions, purchasing documentation, and procurement analysis. Alternate I is narrower and retains only three counterfeit-parts-focused criteria. Under the Basic clauses, separating the requester, buyer, and approver can be a prudent control recommendation, but the clauses do not prescribe three distinct roles or a dollar-based separation.

Receipt separated from the buy

Independently confirming receipt from purchase-order creation can be a prudent control recommendation where risk warrants. DFARS does not expressly require separate buyer and receiver roles, and a Contractor Purchasing System Review evaluates the purchasing system against applicable criteria and the contractor’s documented practices.

Invoice approval separated from the buy

Three-way matching can be a sound recommended control, but DFARS does not expressly require a three-way match or independent invoice approval. If a contractor uses that control, separating invoice review from purchasing can reduce risk; the appropriate design depends on the contractor’s procedures and risk assessment.

Four control points are useful starting points for a GovCon segregation-of-duties readiness review.

Reviewers assess a contractor’s documented procedures, system configuration, and risk. They may examine specific action pairs, but there is no universal four-point test or presumption that every overlap is a material weakness.

Timekeeping: create versus approve

DCAA guidance recommends that each employee record their own time daily. As an internal control, a supervisor should complete an absent employee's timesheet only during a documented, prolonged authorized absence, and the employee should submit a replacement timesheet afterward. These are recommended controls, not universal contractual mandates. An access review can confirm that any such changes remain traceable.

Labor distribution: configure versus post

A prudent readiness review can examine who maintains labor-distribution rules and who posts approved time. Separate roles or an equivalent compensating control can reduce risk, while changes that redirect labor should be documented and approved under contractor policy.

Purchasing: create versus approve

A prudent design may separate buyer creation and negotiation from approval. If approval thresholds are used, the contractor’s documented authority matrix should govern them; DFARS does not prescribe a three-role or dollar-based separation.

Journal entries: post versus reconcile

A prudent design often assigns posting and reconciliation to different roles. DFARS expressly addresses approval and documentation of adjusting entries and reconciliation, but not necessarily separate people; compensating controls may be appropriate.

Each pair can inform an ERP role decision: which permission level a role holds on each transaction type, and whether that role can also hold the approval or reconciliation permission for the same transaction type. These are readiness recommendations to evaluate against the applicable clause and contractor policy, not universal DFARS mandates. This is the same access-control model covered in the guide to NetSuite roles and permissions, applied to control points a business-system review may examine.

Independent readiness advice for ERP role design

Lightbridge ERP is an independent, vendor-neutral ERP readiness advisor. It accepts no vendor kickbacks, no reseller quotas, and no partner-tier incentives, so its advice follows fit and documented requirements, not commission. For government contractors, that advisory work can include helping map timekeeping, labor distribution, purchasing, and journal-entry workflows to applicable criteria and documenting the rationale for a DCAA accounting system review or a DCMA Contractor Purchasing System Review. System approval, disapproval, and material-weakness determinations remain with the cognizant contracting officer. See the guide to government contract project accounting for the cost structure these controls sit on top of.

This guide is general information, not legal, audit, or accounting advice. DFARS clause numbers, withholding percentages, and agency practice change. Verify current specifics against acquisition.gov, DFARS, and official DCAA and DCMA guidance, and consult qualified advisors before acting.

Segregation of duties for government contractors: frequently asked questions

What is segregation of duties in a government contracting context?: Segregation of duties for a government contractor is a control design in which no single person ordinarily controls an entire transaction cycle from initiation to approval and reconciliation. In practice, organizations may separate the person who enters a timesheet from the person who reviews it, the buyer who creates a purchase order from the person who authorizes it, and the preparer who posts a journal entry from the person who reconciles the account it affects. Applicable accounting and purchasing criteria address related control areas, while additional role separation can be a prudent control recommendation; the specific requirements depend on the clause incorporated and the contractor’s procedures. As an independent readiness advisor, Lightbridge ERP can help organizations assess ERP role design against those requirements and risks.
When can a segregation-of-duties gap become a material weakness?: Under current DFARS language, a material weakness is a deficiency or combination of deficiencies in internal control over information in contractor business systems such that there is a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. The existence of a role overlap does not automatically meet that definition. The cognizant contracting officer, considering the applicable system criteria and review findings, determines whether the facts support a material weakness; DCAA and other reviewers distinguish material weaknesses from system deficiencies and less-than-material noncompliance. A role or access gap is one area a review may examine, but its classification depends on the facts, materiality, likelihood, and compensating controls.
What may a DCAA timekeeping review examine for segregation of duties?: DCAA evaluates the accounting system against the current DoD class-deviation criteria in DFARS 252.242-7999; legacy contracts may include 252.242-7006. The criteria include a timekeeping system that identifies employees’ labor by intermediate or final cost objectives and a labor distribution system that charges direct and indirect labor to the appropriate cost objectives. DCAA guidance may also assess supervisor review of time charges. A DCAA review may include interviews, process walkthroughs, and floor checks. Floor checks primarily observe or interview employees to verify attendance, work performed, job classification, and the cost objective charged; they are not principally a trace of recorded hours through the approval chain. Approval and post-approval change controls may be examined separately under DCAA guidance and the contractor’s procedures. An administrator’s ability to recode hours after sign-off is a risk to investigate and document, but it is not by itself an automatic material weakness or failure; the outcome depends on the applicable criteria, facts, and controls.
What control considerations apply under the DFARS purchasing-system rule?: The legacy, codified purchasing-system references are FAR 44.302, DFARS 244.302, and DFARS 252.244-7001. Under the active FAR overhaul (RFO) for current DoD solicitations and contracts, the corresponding figures are FAR 44.301-2, DFARS 244.301-2(a)(1), and DFARS 252.244-7998. The Basic versions of the clauses cover system description, clear authority and responsibility, authorized requisitions, complete transaction history, vendor and price analysis, competition, subcontract surveillance, and internal audits or management reviews. Alternate I is narrower. It retains only three counterfeit-parts-focused criteria. Neither version expressly mandates three distinct requisitioner/buyer/approver roles, dollar-based approval separation, buyer-receiver separation, independent invoice approval, or a three-way match. Those can be prudent recommendations based on risk and documented policy. As an independent readiness advisor, Lightbridge ERP can help map purchasing workflows and access controls to the applicable criteria.
Can the same person post a journal entry and reconcile the account it affects?: The accounting-system clauses require approval and documentation of adjusting entries and reconciliation of subsidiary cost ledgers and cost objectives to the general ledger, but they do not expressly require different people for posting and reconciliation. Assigning those tasks to different roles is a prudent recommended control; smaller teams may need documented compensating controls. This applies whether the entry is a routine correction or a period-end adjustment. As an independent readiness advisor, Lightbridge ERP can help evaluate journal-entry workflows alongside the native approval-routing controls covered in the guide to NetSuite journal entry approval.
What happens if a review identifies a segregation-of-duties deficiency?: The review or audit findings go to the cognizant contracting officer, who makes the applicable system approval, disapproval, and material-weakness determinations. For current DoD class deviations, the relevant clauses are 252.242-7998 for Contractor Business Systems, 252.242-7999 for Accounting System Administration, and 252.244-7998 for Contractor Purchasing System Administration; a legacy contract may still carry 252.242-7005, 252.242-7006, or 252.244-7001. A segregation-of-duties gap is not automatically a material weakness. Withholding under current 252.242-7998 requires a covered contract subject to the Cost Accounting Standards and inclusion of 252.242-7998; inclusion of only an accounting or purchasing clause is insufficient. After a final disapproval and notice to withhold, the current clause generally starts at 5 percent for one system and may reduce directly related withholding to 2 percent when an acceptable corrective-action plan is being effectively implemented. Submission or execution of a plan alone does not end withholding; the contracting officer determines when the material weaknesses are corrected. DCAA generally performs the underlying accounting system review and reports its findings, while DCMA administers the Contractor Purchasing System Review. Verify the incorporated clauses and current process against acquisition.gov and official DCAA and DCMA guidance before relying on a specific figure.
How can ERP configuration support segregation of duties for a government contractor?: ERP role design can support segregation of duties by making recommended separations explicit: a role that can enter or edit a timesheet may be kept separate from timesheet approval, a role that can create a purchase order may be kept separate from approval under the contractor’s authority matrix, and a role that can post a journal entry may be kept separate from reconciliation. These are readiness design examples, not a statement that DFARS requires each exact pairing. This is the same access-control discipline covered in the guide to NetSuite roles and permissions, applied to control points a business-system review may examine. As an independent readiness advisor, Lightbridge ERP can help organizations assess role and workflow design before a review.

From a role that can approve its own work to one that cannot.

When timekeeping, labor distribution, purchasing, or journal-entry workflows need readiness support for a DCAA or DCMA business-system review, Lightbridge ERP provides independent, vendor-neutral advice on role design and documentation.

Talk to an ERP advisor GovCon ERP practice