Segregation of duties
Segregation of Duties (SoD) requires that no single individual has control over all phases of a critical financial transaction. The goal is to prevent fraud and errors by ensuring that at least two people are required to complete a business process.
What it means
The intent of SoD is to reduce the risk of material misstatement in financial reporting. By dividing responsibilities, an organization ensures that for any high-risk activity, one person’s work serves as a check on another's. If one person can initiate, authorize, and record a transaction, they could theoretically commit fraud or make a significant error without detection.
In practice, this applies to both physical processes and digital system permissions. It covers the entire lifecycle of financial data—from the moment a request is made (e.g., a purchase order) to the final reconciliation in the general ledger.
SoD typically focuses on separating four key functions: custody of assets, authorization of transactions, record-keeping, and reconciliation. For example, the person who cuts a check should not be the same person who approves the invoice or reconciles the bank statement.
How to meet it
- Map all critical financial processes (e.g., Procure-to-Pay, Order-to-Cash) to identify where high-risk transactions occur.
- Create an SoD Matrix that explicitly defines which roles are incompatible (e.g., "Vendor Setup" cannot be performed by the same user as "Payment Processing").
- Implement Role-Based Access Control (RBAC) in your ERP or accounting software to restrict system permissions based on the matrix.
- Assign distinct individuals to separate the authorization of a transaction from its execution and recording.
- Establish compensating controls for small teams where full segregation is impossible, such as requiring a senior manager to perform a detailed retrospective review of all transactions.
Evidence an auditor asks for
- User access listings from financial systems showing the specific permissions assigned to each employee.
- An SoD Matrix documenting identified conflicts and how they are mitigated.
- Transaction logs or approval workflows proving that two different users were involved in high-risk processes.
- Signed evidence of compensating controls, such as a manager's sign-off on monthly reconciliation reports.
Common pitfalls
- Privilege Creep: Employees accumulate new permissions when changing roles but retain old ones, eventually gaining conflicting powers.
- Over-reliance on "Superuser" accounts: Granting administrative access to too many people without implementing strict logging and monitoring for those accounts.
- Shared Accounts: Using generic logins (e.g., "Admin" or "Accounting") which makes it impossible to prove which individual performed a specific action.
- Ignoring manual workarounds: Implementing system controls but allowing employees to bypass them via spreadsheets or offline approvals.