Stop Dealer Fraud in 30–90 Days with Dealership Segregation of Duties

Yes, a dealership needs clear segregation of duties: separate who approves, who records, and who holds custody of cash, parts, and titles. Success looks like a documented RACI, a DMS access matrix that enforces least privilege, and scheduled reconciliations that someone other than the person doing the work reviews. Start this week by pulling a current DMS access report and putting a name on the calendar for a monthly reconciliation review.

TL;DR:

Most dealerships lack a formal RACI or access matrix, which often leads to privilege creep and untracked exceptions in financial processes.

Segregation failures commonly occur in parts, cash, F&I, and titling, where one employee controls both custody and record-keeping, increasing fraud risk.

Regular reviews of voided receipts, access rights, and physical inventory counts are essential to detect and prevent theft or errors early.

Implementing role-based permissions, scheduled reconciliations, and exception logging can establish effective segregation without additional staff.

Documented controls and periodic audits protect dealerships from legal liabilities, licensing violations, and reputational damage caused by internal fraud.

What Is Dealership Segregation of Duties, In Practice?
How to Map Duties: RACI and an Access Matrix
Where Segregation Fails: Parts, Cash, F&I, and Titling
Rolling Out Segregation of Duties in 30, 60, and 90 Days
Ongoing Monitoring and the Red Flags That Matter
Technology and Controls That Make Segregation Stick
Legal and Compliance Requirements Tied to Segregation of Duties
The Real Impact of Segregation of Duties on Dealership Fraud
What Happens When Segregation of Duties Breaks Down
Segregation of duties protects people, not just profit
How Loturn Supports Segregation of Duties Without the Admin Load
Sources
FAQ

What Is Dealership Segregation of Duties, In Practice?

Segregation of duties splits every financial process into three roles: who approves a transaction, who records it, and who has custody of the underlying asset (cash, inventory, or a title). When one person controls all three, mistakes go unnoticed and fraud becomes trivial to hide. The CPA guidance on internal controls is blunt on this point: accounts payable staff should never also sign checks or reconcile the bank statement themselves.

Here’s the fast checklist most dealerships are missing pieces of:

Accounts payable vs. check signer. The person entering bills should not be the person cutting checks.
Inventory custody vs. inventory records. Whoever holds keys and physical stock should not be the one adjusting the DMS inventory count.
High-risk zones to flag first: cash receipts, parts ordering and vendor setup, refund processing, and title/registration edits.
This week’s action items: document current role assignments, run a DMS access report, and name one owner for reconciliation reviews.

If your dealership can’t answer “who else would catch this?” for a given task, that task isn’t segregated yet.

How to Map Duties: RACI and an Access Matrix

A RACI chart (Responsible, Accountable, Consulted, Informed) turns vague job titles into a document you can audit. Build it in three steps:

List every financial process — cash deposits, parts receiving, deal funding, title processing, refunds — down the rows.
Assign RACI roles per process. Example rows: cashier is Responsible for daily deposits, office manager is Accountable; parts manager is Responsible for receiving, general manager is Accountable for approving new vendors; F&I manager is Responsible for deal structure, controller is Accountable for post-funding review.
Translate each “Responsible” and “Accountable” cell into a DMS permission set. If the cashier shouldn’t edit the general ledger, their login shouldn’t allow it, regardless of what the default role template grants.
Log every exception. If a manager temporarily needs cross-role access during a staff shortage, write it down, with a date to revoke it.
File approvals and exception logs somewhere searchable, not in someone’s email inbox.

This mapping exercise usually surfaces two or three people holding access nobody remembers approving, which is exactly the privilege creep the WardsAuto reporting on employee-fraud risks at car dealerships warns about.

Where Segregation Fails: Parts, Cash, F&I, and Titling

The parts department is where a lot of dealerships get burned first. A parts employee who can both receive inventory and create new vendor accounts can invoice the dealership for parts that never arrive, and a documented case shows this kind of scheme can cost a dealership hundreds of thousands of dollars before anyone notices. The fix is structural: someone other than the receiver signs off on receiving counts, and vendor creation requires a second approver.

Cash receipts carry similar risk. A cashier who can void a transaction and pocket the difference will keep doing it until someone reviews the void log.

Parts: separate receiving sign-off, inventory custody, and vendor setup.
Cash: require manager review of every voided receipt, monthly at minimum.
F&I/deal edits: restrict who can change a funded deal, and require a second signature on post-funding adjustments.
Titling and refunds: the person processing a refund should never be the one reconciling that account.

Pro Tip: Pull your monthly voided-receipts list and check it against manager approvals before you check anything else. It’s the fastest way to catch cash skimming, and the Digital Dealer internal controls guide treats it as a baseline monthly task, not an occasional audit step.

Rolling Out Segregation of Duties in 30, 60, and 90 Days

You don’t need a consultant to start this. You need a sequence.

Days 1 to 30: Inventory and prioritize. List every financial process, flag the highest-risk ones (cash, parts, titling), and pull a full DMS access report to see who actually holds what permissions today.
Days 1 to 30: Build the RACI and access matrix. Convert responsibilities into least-privilege DMS roles, and document every exception with a reason and a revocation date.
Days 30 to 60: Set reconciliation cadence. Daily bank deposits get reviewed the same day; weekly parts counts get reconciled against the DMS; monthly bank and GL reconciliations get signed off by someone who didn’t record the transactions.
Days 30 to 60: Establish approval gates. Define dollar thresholds and edit types that require a second signature, particularly on deal changes and refunds.
Days 60 to 90: Test it. Run a simulated exception, a voided receipt, a manual deal edit, and confirm the review process actually catches it.
Days 60 to 90: Train staff and assign permanent owners. Every gate needs a named person responsible for enforcing it, not a policy binder nobody opens.

Pro Tip: Assign one person, usually your controller or office manager, as the owner of the reconciliation calendar. Reconciliation without an accountable owner tends to quietly stop happening after month two.

Ongoing Monitoring and the Red Flags That Matter

Segregation of duties isn’t a one-time setup. Access rights drift as people change roles, get temporary exceptions, or leave the company, and dealerships that don’t schedule reviews tend to find stale permissions months or years later.

Quarterly access reviews catch privilege creep before it becomes a habit rather than an exception.
Reconcile your HR termination list against active DMS accounts monthly. Lingering access for departed employees is one of the most common findings when dealerships pressure-test their internal controls.
Watch exception reports: repeated voided receipts from the same employee, frequent manual overrides, or deal edits made after funding all deserve a second look.
Use routine reconciliations and physical inventory counts as your early-warning system, not just your bookkeeping chore.

None of this requires new software to start. It requires someone with the authority to ask uncomfortable questions and a calendar reminder that doesn’t get snoozed.

Technology and Controls That Make Segregation Stick

Software helps, but only when it’s configured deliberately rather than left on factory defaults.

Least-privilege roles, multi-factor authentication, and activity logging turn “we trust our staff” into “we can prove what happened,” which matters equally for honest disputes and dishonest ones.
Per-car costing and automated bank-feed reconciliations cut down on manual journal entries, and every manual entry is a place where segregation can quietly break down. The Crowe LLP guidance on internal controls specifically recommends segregating preparation, review, and recording of journal entries, and limiting general-journal access to a small number of people.
Run your existing DMS and accounting reports on a schedule, not just when something looks wrong. Most systems already generate the void logs and access reports dealerships need; the gap is usually that nobody reviews them monthly.
Don’t assume vendor defaults fit your dealership. Out-of-the-box role templates are built for the average customer, not your specific risk points.

Legal and Compliance Requirements Tied to Segregation of Duties

There’s no single federal statute that says “a dealership must segregate duties X, Y, and Z.” Instead, the requirement shows up indirectly, through several overlapping obligations that make weak internal controls a legal liability, not just an operational one.

Dealerships financing vehicles or holding customer financial data fall under the FTC’s Safeguards Rule, which requires a written information security program, including access controls limiting who can view or alter customer financial records. Weak segregation, where one employee can both originate and approve a financing transaction, undermines that requirement directly. Dealerships are also considered “creditors” under FTC Red Flags Rule guidance, meaning they must have a written identity theft prevention program watching for red flags in credit applications and title transactions, a task that depends on someone other than the originating employee reviewing the file.

State dealer licensing boards frequently require documented recordkeeping for titling, odometer disclosures, and deal files, and inconsistent controls around who can edit those records after the fact can trigger licensing violations independent of any fraud finding. Sales tax authorities and floorplan lenders conduct periodic audits that assume basic separation between the person who books a sale and the person who reconciles the account; audit findings citing a lack of segregation can affect floorplan terms.

None of this requires a compliance department. It requires documentation showing who can do what, and evidence that someone reviews the exceptions.

The Real Impact of Segregation of Duties on Dealership Fraud

Segregation of duties works because it removes the single point of failure that most dealership fraud depends on. Nearly every fraud scheme uncovered at a dealership, whether it’s a parts scam, a cashiering skim, or a phantom deal, requires one person to control both the transaction and its record. Break that link, and the same employee who wanted to commit fraud now needs a second person to either approve it or fail to notice it, which is a much higher bar.

This matters as much for honest mistakes as deliberate theft. A CPA’s breakdown of dealership internal controls frames segregation as protection against both misstatements and mistakes, not just intentional wrongdoing, because the same review step that catches a thief also catches a data-entry error before it distorts your monthly financials.

The prevention value also compounds with detection speed. A dealership running monthly voided-receipts reviews and quarterly access audits catches problems in weeks. A dealership relying only on an annual outside audit might not discover a scheme until it’s been running for a year, by which point the loss and the reputational damage are both much larger. Segregation doesn’t just reduce the odds of fraud happening; it shrinks the window during which it can go undetected, which is often where the real financial damage accumulates.

What Happens When Segregation of Duties Breaks Down

The parts department case referenced by ARB CPA is a useful real-world illustration because it shows how ordinary the failure point usually is. An employee with both receiving authority and the ability to create vendor accounts submitted invoices for parts orders placed outside the normal purchasing system, paid through channels that bypassed the usual approval chain. Nobody was watching because no single control point existed that required a second person to verify the parts had actually arrived before payment went out. The loss reportedly ran into the hundreds of thousands of dollars before it surfaced.

What makes this pattern common rather than rare is that it doesn’t require a sophisticated scheme. It requires exactly one gap: a single employee trusted with both custody (receiving) and a recording-adjacent power (vendor setup) that nobody else double-checked. Cashiering fraud follows the same shape at a smaller scale, one employee with both transaction authority and void authority, unreviewed for months. Titling errors and refund fraud follow it too, when the person processing a refund is also the person who reconciles that account against the bank statement.

The consequences extend past the dollar loss. Dealerships that discover fraud after the fact often face floorplan lender scrutiny, insurance claim disputes, and in some cases state licensing board inquiries if the fraud touched title or odometer records. The fix in every one of these cases is the same one described throughout this guide: no single employee holds approval, custody, and recording power over the same process.

Segregation of duties protects people, not just profit

The instinct to treat segregation of duties as a distrust signal is backwards. A documented access matrix protects your best employees from being falsely suspected when something goes wrong, and it protects the business from losses that often surface only after they’ve compounded for months.

Smaller dealerships without the headcount for full segregation aren’t stuck. Documented compensating controls, an owner personally reviewing weekly parts counts, or a bookkeeper cross-checking deposits against DMS records, close most of the gap without adding staff. What matters is that the control is written down and someone actually performs it.

— Eric Dosset

How Loturn Supports Segregation of Duties Without the Admin Load

Loturn is built around the same principle this whole guide is built on: no single view of your numbers should depend on one person’s memory or one person’s unchecked access. Per-car costing tracks every dollar tied to a vehicle, from acquisition through recon and transport, so managers get review-ready profit reports instead of a pile of receipts someone has to reconstruct by hand.

Role-based access lets you decide exactly who can enter costs, who can approve them, and who can only view reports, matching the separation-of-duties structure covered in the RACI and access matrix section above without forcing you to fight your accounting software’s default permissions. Bank-level encryption protects that data, and native reconciliation tools cut down on the manual journal entries that create most segregation gaps in the first place. If you’re piecing together spreadsheets, a general ledger, and a separate inventory tracker right now, that’s usually where duties blur without anyone intending it to happen.

Start a free trial of Loturn’s dealer accounting platform, and its team will help migrate your existing data so you can see clean, per-car numbers within days, not weeks.

Sources

FAQ

What are some examples of segregation of duties in a dealership?

Common examples include separating the person who receives parts inventory from the person who approves new vendors, and keeping the employee who processes cash receipts separate from the one who reconciles the bank deposit.

What is the red flag rule for car dealers?

The FTC Red Flags Rule requires dealerships that extend credit to maintain a written identity theft prevention program that watches for warning signs on credit applications and title paperwork, reviewed by someone other than the person originating the transaction.

Who is responsible for segregation of duties at a dealership?

Ultimate responsibility sits with the owner or general manager, but day-to-day ownership usually falls to the controller or office manager, who maintains the access matrix and runs the reconciliation schedule.

How does segregation of duties work in practice?

It works by splitting approval, custody, and recording across different people for the same transaction, so no single employee can both create a loss and hide the record of it, and documented reconciliations catch what one person’s oversight might miss.

Do small dealerships need a full segregation-of-duties program?

Smaller dealerships can rely on documented compensating controls, such as an owner personally reviewing weekly reconciliations, instead of hiring extra staff, as long as the review actually happens and is written down.