Internal Controls
Segregation of Duties: How to Find and Fix Conflicts in Your Systems
Segregation of duties is the most important preventive control — and the one most often eroded by growth and new systems. A practical guide to getting it right.
Segregation of duties (SoD) means that no single person controls a transaction from beginning to end. It is the simplest and most powerful defence against both error and fraud — because committing and concealing a fraud becomes much harder when it requires two people.
The four functions to keep apart
For any significant process, separate:
- Authorisation — approving the transaction
- Custody — handling the asset (cash, inventory, access to bank)
- Recording — entering the transaction in the books or system
- Reconciliation / review — checking that records match reality
Classic conflicts
| Conflict | Risk |
|---|---|
| Create vendor + approve payment | Payments to fictitious vendors |
| Create purchase order + receive goods | Payment for goods never received |
| Maintain employee master data + run payroll | Ghost employees, inflated salaries |
| Post journal entries + approve them | Concealment of misappropriation |
| Develop code + migrate it to production | Unauthorised system changes |
| Issue credit notes + manage customer receivables | Diverted customer payments |
How to find SoD conflicts
- Build an SoD ruleset. List sensitive activities per process and which combinations are not allowed.
- Extract access data. Pull users, roles and permissions from your ERP, HR, banking and other key systems.
- Analyse. Compare what users can do against the ruleset. Most ERP and GRC tools support this; for smaller environments a structured spreadsheet analysis works.
- Check usage. A user with conflicting access who has actually executed both sides is a priority to investigate.
How to fix them
- Redesign roles so standard roles do not contain conflicts by design.
- Remove unnecessary access — conflicts often come from people who changed jobs and kept old rights.
- Use compensating controls where the team is too small to separate duties: an independent review of vendor changes, payment runs or journal entries by someone outside the process.
- Control emergency access (“firefighter” IDs) with logging and after-the-fact review.
Keep it clean
SoD is not a one-off clean-up. Embed it in joiner–mover–leaver processes, review sensitive access at least quarterly, and include SoD design in every system implementation — fixing it after go-live is always more expensive.
Need help? Our internal controls review includes SoD and user-access analysis, and our IT project management practice builds SoD into new systems from day one.