Segregation of duties — SoD — rests on a simple idea: no single person should be able to carry out a sensitive operation from end to end. Creating a supplier and approving its payment, editing a payslip and signing it off: these combinations open the door to fraud and sit at the top of most audit findings.
The principle is uncontroversial. Putting it into practice is less so, because it touches how people work every day.
Why conflicts pile up
In most organisations, rights have accumulated over time. Someone changes role and keeps their old access. A temporary cover becomes permanent. An urgent situation justifies extended rights that nobody later withdraws.
After a few years, no one knows precisely who can do what — and the question only really surfaces when the auditor arrives.
A five-step approach
1. Map the rights actually granted
The first surprise is usually the gap between theoretical rights, as described in roles, and effective rights, inherited through accumulated assignments. Effective rights are what count. This mapping needs tooling; across several thousand users, it cannot be done by hand.
2. Choose a risk matrix
An SoD matrix lists forbidden combinations and how critical each one is. There is no need to write one from scratch: existing frameworks cover standard processes — procurement, sales, treasury, payroll. Your work is adapting it to your specifics, not building the foundation.
3. Prioritise before fixing
A first analysis often returns hundreds of conflicts. Trying to resolve them all at once is the surest way to resolve none. Two criteria help: the financial criticality of the conflict, and how many users it affects. Critical conflicts affecting few people are quick to fix and show visible results.
4. Fix, or document a compensating control
Not every conflict can be removed. In a small team, one person sometimes holds several functions out of necessity. The acceptable answer is a compensating control: a systematic, documented and traceable review of the operations concerned. An auditor will accept a risk that is acknowledged and monitored; they will not accept one that is ignored.
5. Prevent rather than discover
The step that changes everything: simulate the impact before granting a role. The administrator sees immediately whether the assignment creates a conflict and can decide accordingly. Without this, the clean-up starts over a few months later.
Emergency access
That leaves exceptional interventions, which require elevated rights. Removing them is unrealistic; leaving them unframed is not an option either. Common practice is to grant them for a limited period, after approval, with a full log of the actions performed and a review afterwards.
What it changes at audit time
An organisation that controls its segregation of duties does not merely state that access is under control: it demonstrates it, with time-stamped reviews signed off by managers. In the audit room, that difference is considerable.
Scoolis deploys Pathlock across SAP, Oracle, Microsoft Dynamics, Salesforce and Workday. Explore access governance.