Internal Controls Review: Testing 5 Bonsai Workflows for Duty Gaps

This reference maps five Bonsai workflows—invoice creation, payment approval, expense recording, client credit/retainer handling, and reconciliation—to the four AICPA duty categories. It flags duty gaps when one user role touches authorization, custody, recordkeeping, or reconciliation in three or more categories.

How Bonsai duty gaps actually form

The mechanism behind Bonsai's duty gaps is simple: a trusted person is not a control. That insight comes from Yuval, founder and CEO of Glitter AI, who described in a May 2026 internal controls guide how an auditor's walk-through exposed that his company's "control" was really one careful finance person who approved payments, entered them, and reconciled the account — because it was her, it was fine. As he put it, that wasn't a control; it was a person they trusted, which is exactly what internal controls are supposed to replace.

Bonsai recreates that same pattern structurally. Because the platform consolidates invoicing, contracts, payments, expense tracking, and accounting in one place, a single admin login can authorize, execute, and record the same transaction — the exact combination COSO's control activities component is designed to split apart, per the Glitter AI guide. The tool isn't careless; it's concentrated. Concentration is the gap.

To see where the gap forms, map each workflow step to the four function-based categories the AICPA uses to define segregation of duties — authorization, custody, recordkeeping, and reconciliation (a definition also laid out by SailPoint). A gap exists whenever one person holds three or more of those categories for the same transaction. In Bonsai's default setup, an admin creating an invoice touches authorization (deciding to bill), recordkeeping (generating the invoice record), and often reconciliation (matching the incoming payment) in one session. That's three of four categories in a single role, with no second person in the loop.

The practical check: for each of the five workflows — invoice creation, payment approval, expense recording, retainer/credit handling, and reconciliation — list every step, tag it with one of the four categories, and count how many categories each role touches. Any role hitting three or more is a documented gap, not a judgment call. This turns "we're careful" into something testable, which is the distinction the Glitter AI walk-through makes central: the difference between careful and provable.

One caution when running this mapping: don't count a role restriction as a control until you verify it in the product. Bonsai's permission settings determine whether an admin can actually be limited to recordkeeping only, or whether the platform forces one role across multiple categories. If the setting can't split the duties, the gap is structural, and the fix has to come from process — approval routing or a manual review step — rather than configuration. That distinction between what the software can enforce and what only a human checkpoint can enforce is what the scoring matrix in the next section is built to capture.

The evidence on duty separation

Before running any workflow test in Bonsai, the rubric itself needs an anchor, and three sources converge on the same answer. The AICPA defines segregation of duties as being "based on the shared responsibilities of a key process that disburses the critical" assets — a definition quoted by SCH Group in its segregation-of-duties guidance. Read that definition carefully and it tells you where to aim first: disbursement processes. In a Bonsai review, that means invoice payment approval and retainer release are the highest-priority test targets, ahead of anything that merely records or reports.

The second anchor is COSO, which splits internal control into five components: control environment, risk assessment, control activities, information and communication, and monitoring. As the Glitter AI internal controls guide puts it, when people say "internal controls," they usually mean the third component — control activities, the day-to-day checks. That is the testable core for a Bonsai review. The other four components matter, but a solo operator evaluating a software workflow can only observe control activities directly: who clicks approve, who enters the payment, who runs the reconciliation. The rubric therefore scores what is observable in the tool, not what is aspirational in policy.

The third anchor is Hyperproof's risk framing, which treats segregation of duties as a control over funds and other assets and organizes it around four function-based categories: authorization, custody, recordkeeping, and reconciliation. SailPoint describes the same four categories. Together, these give the test its scoring rule: map every step of a Bonsai workflow to one of the four categories, and flag any workflow where a single user role touches three or more of them. Three out of four is the threshold because a role that authorizes, holds assets, and records its own activity has effectively eliminated any independent check — the software's audit trail shows what happened, but not that anyone else could have stopped it.

The convergence matters because each source covers a blind spot in the others. AICPA tells you which processes to test first (disbursements); COSO tells you which layer to test (control activities, not culture or monitoring); Hyperproof and SailPoint tell you how to score each step (the four categories). A rubric built on any one alone would either test everything equally, test the wrong layer, or score steps without a failure threshold.

One practical check before applying the rubric: confirm that the Bonsai roles you are testing map to real people, not to a shared login. If two staff members use one account, the workflow test will show clean separation that does not exist in practice. Verify the user list in the tool against your actual team roster first, then run the workflow mapping — otherwise the matrix scores the account structure, not the duties.

Five workflows, one gap matrix

The test list is deliberately short: five Bonsai workflows, each mapped step by step to the four AICPA duty categories — authorization, custody, recordkeeping, reconciliation. SailPoint's breakdown of those four function-based categories is the scoring key. Every step in a workflow gets exactly one label. Then you count how many labels land on a single user role. Any workflow where one role touches three or more categories is a gap, and the matrix makes that visible in one pass instead of a paragraph of prose.

Workflow 1 — invoice creation. Walk the path: create the invoice, send it, record the receivable, mark it paid. The check is whether the person who creates the invoice in Bonsai can also mark it paid. If yes, that single role holds authorization (issuing the billing document) and recordkeeping (updating payment status) at once. Score it as a gap, not a convenience. The test is binary: attempt both actions under one login and record which categories the role touched.

Workflow 2 — payment approval. Here the question is whether Bonsai's payment collection — credit card or ACH through the integrated processor — requires a distinct approver before funds move. Trace the sequence: who initiates the charge, who approves it, who sees the settlement. A self-approving owner-operator is a known gap to document, not hide. The matrix entry is the count of categories that role touches; if approval and custody sit with the same person, the row fails the three-category rule.

Workflow 3 — expense recording. Test whether the person who incurs an expense can also categorize it and approve its reimbursement. Incurring the cost is custody; categorizing it is recordkeeping; approving the payout is authorization. One login performing all three is the classic single-role concentration, and it belongs in the matrix as a failing row.

Workflow 4 — retainer and client credit handling. Apply the same trace to applying a retainer or credit to an invoice: who authorizes the credit, who holds the client funds, who records the application, who reconciles the balance. Workflow 5 — reconciliation. Check whether the person who reconciles the Bonsai ledger against the bank or processor statement is the same person who recorded the underlying transactions. If so, recordkeeping and reconciliation collapse into one role.

Score each row by counting categories per role, not per workflow. The matrix does the work: five rows, four columns, and any row where one role's marks reach three columns is the finding you carry into remediation. This is the five-workflow test list itself, scored in a single matrix — nothing more, nothing less.

Remediation options and costs

Three remediation paths are available once a workflow shows one role touching three or more duty categories, and they are not equal in cost or coverage. Option A is role restriction inside Bonsai: downgrade secondary users to view-only or task-scoped permissions so a single login can no longer authorize, record, and reconcile the same transaction. The software cost is near zero, but the seat cost is not — a restricted user may still need a paid seat to see the records they are permitted to touch. Verify current seat pricing on Bonsai's own admin billing page at test time rather than relying on review articles, which lag pricing changes.

Option B is approval routing: insert a mandatory second-person sign-off before an invoice, refund, or payment leaves the system. This directly converts an authorization gap into an authorization control, because the person who initiates the transaction can no longer be the only person who approves it. The cost is process friction — roughly minutes per transaction, plus the risk that approvers rubber-stamp requests they did not originate. Approval routing fixes authorization only; it does nothing for custody, recordkeeping, or reconciliation gaps.

Option C is compensating manual review: leave the roles as they are and add a periodic human check — an owner or bookkeeper who reviews the transaction log, matches entries to bank activity, and documents exceptions. This is the weakest of the three because it is detective, not preventive, and it depends on the same trusted-person dynamic that created the gap. A review that happens monthly cannot stop a payment that clears today.

The winner is Option A, paired with Option B where the workflow involves disbursement. Role restriction is the only path that removes the structural cause — one login spanning multiple duty categories — rather than adding a check on top of it. Approval routing is the correct supplement for any workflow that moves money, because it restores the second-person authorization step that role restriction alone cannot create. Manual review is a fallback for workflows where neither restriction nor routing is feasible, not a substitute for either.

Before choosing, confirm two things at test time: the current per-seat price on Bonsai's admin billing page, and whether the workflow's duty gap sits in authorization (fix with B), in custody or recordkeeping (fix with A), or in reconciliation (fix with A first, C only if A is blocked). A remediation that does not match the gap category is cost without coverage.

What this test does not prove

The matrix has limits, and the fastest way to lose credibility with a controller or an outside CPA is to pretend otherwise. Two edge cases break the clean mapping of every Bonsai step to authorization, custody, recordkeeping, or reconciliation — and both need to be named before anyone treats a gap score as final.

The first is the true owner-operator. A solo freelancer running Bonsai alone cannot segregate duties against themselves; every step in every workflow lands on one person by definition. The matrix still wins here, because it correctly shows one role touching all four categories — the failure mode is real, not an artifact. What changes is the remediation. Internal separation is unavailable, so the fix becomes documented external review: an outside accountant reconciles the books on a fixed quarterly cadence, and the owner keeps a dated log of those reviews. The check is whether a second party, outside the firm, touches reconciliation at least once per quarter and leaves evidence. If no such review exists, the owner-operator has no compensating control at all, and the matrix score should be read as a finding, not a formality.

The second edge case is automation. When Bonsai auto-matches payments to invoices, the system itself performs recordkeeping — no human role does. A naive reading of the matrix would score that step as unassigned and move on. The correct test asks a different question: who can override the automation? An override right is an authorization duty, and it belongs in the authorization column even though no person performed the original match. The check is to pull the permissions list for every automated matching feature in use and confirm that override access is held by a role separate from custody and reconciliation. If the same admin who holds the bank feed can also override matches, the automation has not removed the gap — it has hidden it.

Both cases share a rule: the matrix maps duties to roles, so when a role is missing or a machine stands in for one, the test must locate the nearest human authority — the reviewer, the overrider, the approver — and score that. Skipping this step produces false passes.

What this test also does not prove: it does not measure whether controls operate consistently over time, only whether the duty structure exists on the day of review. A passing matrix is a floor, not a certification. Pair it with the walk-through evidence and the quarterly external review, or the score means less than it appears to.

And test checklist

Start with the smallest configuration that can still expose a gap: a two-user firm with one Owner account (Admin) and one Bookkeeper account scoped to a limited task set. Workflow 1 is invoice creation, and the test document is a single client invoice. Before touching the software, write the rule at the top of your worksheet: map every step of the workflow to one of the four AICPA duty categories — authorization, custody, recordkeeping, and reconciliation — and flag any workflow where one user role touches three or more of them (SailPoint). The count, not the job title, is what you are testing.

Checkpoint 1, creation. Sign in as the Bookkeeper and create the invoice. The duty in play is recordkeeping: this is the person who puts the transaction into the books. Observed result — allowed. Record "recordkeeping / Bookkeeper / allowed" on the row. On its own that is not a finding; it is the baseline the next checkpoint is measured against.

Checkpoint 2, send and approve. Sign in as the Owner and complete the send. This step is authorization, the decision to release the document. Observed result — allowed only if approval routing is enabled, so the real test is whether the Bookkeeper can send without Owner approval. Switch back to the Bookkeeper account and try to send that same invoice; if it goes out, authorization and recordkeeping now sit in one role. Then check the mirror condition: can the Owner also create invoices? If yes, the Owner holds authorization plus recordkeeping on the same document, and the approval step is a formality rather than a check.

Repeat the same two-checkpoint pattern for the other four workflows and log results in the worksheet below. One row per workflow, one column per duty, one named role per cell. For example, if the Owner both creates and sends the invoice while the Bookkeeper only records it, the invoice-creation row would show the Owner in the authorization and recordkeeping columns and the Bookkeeper in none — a single role touching two categories, below the three-category threshold.

Read the last column first. Any row where the same role name appears three or more times is a gap under the rule you wrote at the top, no matter how careful that person is. Keep the completed sheet and re-run it whenever role assignments or approval settings change, because the invoice send step depends on a configuration toggle that can be switched without any change in who does the work. For instance, if the Owner appears in the authorization, recordkeeping, and reconciliation columns of the invoice-creation row, that row is a gap and should be carried into remediation.

Decision rules for your gap report

The gap matrix tells you where Bonsai forced one role across three or more of the four duty categories; the report itself needs an if/then ruleset that converts each hit into an action, an owner, and a way to verify the fix. These are the decision rules to apply row by row.

Rule one: authorization plus custody on the same funds flow. This is the highest-severity hit, and it lands in the payment-approval and retainer/credit workflows. SailPoint groups authorization and custody among the four function-based duty categories precisely because the person who releases a payment should not also hold or move the underlying funds; where that overlap exists, what you have is a trusted person rather than a control, as Yuval of Glitter AI describes the pattern. IF one role both approves and has custody of the same disbursement, THEN enable approval routing in Bonsai before the next disbursement goes out. The check: open the next pending payment and identify who created it and who can approve it. Matching names means the rule fires. Treat this as a same-day configuration change, not a quarter-end project.

Rule two: recordkeeping plus reconciliation on the same account. IF the same user posts entries to an account and also reconciles that account, THEN reassign the reconciliation to a different user or to an external accountant at each close. The check is a two-column list pulled from Bonsai: who records, who reconciles. Any account that appears under one name in both columns goes on the reassignment list before the next close, because the reconciliation step is what would otherwise catch that user's own recording errors. For example, if the Bookkeeper both enters and reconciles the operating account, move the reconciliation to the Owner or an outside accountant.

Rule three: the solo operator. IF you are a true solo operator with no second user available, THEN structural separation is not achievable in Bonsai. Document the gap in writing — the account, the functions combined, and the date observed — add a quarterly external reconciliation review, and disclose the compensating control in your written policy so a reviewer sees the mitigation alongside the gap. An undocumented solo gap reads as an unknown gap; a documented one with an outside review attached reads as a managed risk.

Two formatting rules keep the report usable. Write each row as IF (the specific step where the overlap occurs) THEN (the specific action), and pair every action with the evidence that proves it happened — an approval-routing setting, a reassignment record, or an engagement letter from the external reviewer. Second, do not recycle a fix across gap types. Approval routing addresses authorization-and-custody overlaps; reassigning reconciliation addresses recordkeeping-and-reconciliation overlaps. Applying the wrong rule leaves the original overlap intact and gives the report a false clean line.

What to do next

Frequently Asked Questions

How many duty categories must one user role touch before a Bonsai workflow is flagged?

Under the reader rule, a workflow is flagged when one user role touches three or more of authorization, custody, recordkeeping, or reconciliation.

Can reconciliation be folded into recordkeeping when testing Bonsai workflows?

Reconciliation is its own AICPA duty category in the thesis, so it cannot be folded into recordkeeping when testing Bonsai workflows.

How should each identified duty gap be documented?

Document each gap as preventive or detective with segregation-of-duties evidence.

What does the internal-controls guide call for?

The internal-controls guide calls for preventive vs detective controls, segregation of duties, and documentation aligned to SOX requirements.

Is a trusted person considered a control in Bonsai's duty-gap mechanism?

The mechanism behind Bonsai's duty gaps is simple: a trusted person is not a control.

Which Bonsai workflows must be mapped to the four AICPA duty categories?

The required workflow set is invoice creation, payment approval, expense recording, client credit/retainer handling, and reconciliation.

Quick answers

Also worth reading: Demystifying Internal Controls in Accounting Your Expert Guide: Demystifying Internal Controls in Accounting · The Core Principles and Attributes of Sound Internal Controls: Core Principles and Attributes of · Are Your Internal Controls Actually Protecting Your Finances: Are Your Internal Controls Actually