Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Segregation of duties (SoD), also called separation of duties, is an internal control that divides important responsibilities among different people or organizational groups. It is designed to keep one person from controlling every key stage of a transaction or change, making errors and misuse more likely to be prevented or detected.
What segregation of duties means
SoD is a way to design work so that no individual can independently carry out and conceal a problematic transaction or change. The U.S. Government Accountability Office (GAO) identifies authorization, processing and recording, review, and handling related assets as responsibilities that may need to be divided, depending on the process and its risks. Its internal-control standard says one person should not control all key aspects of a transaction or event. GAO, Standards for Internal Control in the Federal Government
SoD is a control principle, not a guarantee that every action will be authorized or that fraud cannot occur. Separation reduces opportunities for undetected error or misuse; weak separation can expose an organization to improper transactions, unauthorized program changes, or damage to computer resources. GAO, Federal Information System Controls Audit Manual
Which responsibilities should be separated?
There is no universal role list that fits every organization. Map the process and consider whether one person’s access or responsibilities could let them initiate, authorize, execute, record, conceal, and review the same event. Separate the combinations that pose meaningful risk to the organization’s assets, systems, records, or operations.
#1 Best Overall
- Authorization and execution: The person approving a transaction should not also be able to carry it out without an appropriate independent check.
- Processing and recording: Separate performing a transaction from maintaining the records that show what happened when that separation is warranted.
- Custody and recordkeeping: Consider separating access to cash or other assets from the ability to alter the related accounting records.
- Development and release: For IT changes, distinguish authorization, development, testing, review, and release so one person cannot independently control the full change process.
- Review: Assign review to someone with enough independence and access to identify mistakes or unusual activity.
GAO recommends analyzing operations, assigning incompatible duties across people or units where feasible, and documenting and communicating responsibilities. Physical and logical access controls help ensure that assigned boundaries are reflected in the workplace and systems; supervision and review address risks that permissions alone do not control. GAO, Federal Information System Controls Audit Manual
Segregation of duties examples
Payroll
A person who can authorize, process, and review payroll could increase selected payments and leave the change undetected. Dividing those responsibilities gives another person a meaningful opportunity to approve or identify an improper payment. GAO, Federal Information System Controls Audit Manual
Software changes
A programmer should not independently write, test, and approve a program change. Depending on the system’s risk, an organization can assign user authorization, development, testing, review, and release to separate people or groups, and restrict access that would let someone bypass those boundaries. GAO, Federal Information System Controls Audit Manual
Accounts payable
Oracle’s guide to Fusion Applications gives creating payables invoices and creating payables payments as an example of incompatible duties. It also describes separating supplier bank-account updates from invoice approval. These are examples of configurable application policies—not requirements that every organization must adopt in exactly the same way. Oracle Fusion Applications Common Implementation Guide, 11g Release 1
Rank #3
Cash receipts and accounting records
If the person handling cash receipts can also make accounting entries, they may be able to change records to conceal a shortage. An independent review of entries can help detect that kind of manipulation. GAO, Federal Information System Controls Audit Manual
How to put SoD into practice
- Map the process. List who can initiate, approve, execute, record, review, or handle the assets involved. Include system access paths, not only formal job titles.
- Identify incompatible combinations. Assess how someone could misuse a combination of responsibilities or permissions, and what harm could result. Set the level of separation according to the process and risk.
- Assign and document responsibilities. Divide duties among people or units where feasible. Record who owns each responsibility and communicate the assignments.
- Make the boundaries effective. Use physical and system access controls to prevent users from carrying out tasks outside their assigned responsibilities. Add supervision or review where a permissions boundary is not enough.
- Review access and controls over time. Jobs, systems, and processes change. Have appropriate owners approve access that creates a conflict, review access periodically, and monitor any approved exceptions. Keep evidence of approvals and reviews.
In applications, SoD policies can flag incompatible privileges, roles, or combinations of permissions. They may also apply conditions such as business unit. The right rules depend on actual processes and risk tolerance; a role matrix or vendor rule set should not be treated as universally correct. GAO notes that automated conflict tools rely on sound business rules, while Oracle’s guide describes configurable policy examples and cautions that greater segregation can add implementation and maintenance complexity. GAO, Federal Information System Controls Audit Manual; Oracle Fusion Applications Common Implementation Guide, 11g Release 1
Rank #4
What to assess in a manual or automated control
- Prevention or detection: Does it block conflicting access before assignment, or identify a conflict for review after access is assigned or activity occurs?
- Coverage and rule quality: Does it cover the relevant roles, privileges, processes, and business context? Are the conflict rules based on how work actually happens?
- Review evidence: Can the organization show who approved an exception, reviewed access, or monitored a compensating control?
- Ongoing ownership: Who maintains the rules and conducts periodic reviews, and how much implementation and maintenance work will that require?
What to do when full separation is impractical
Small teams may not have enough staff to assign every step to a different person. GAO guidance recognizes that management may accept selected conflicts because of resource limits and risk considerations, provided suitable compensating controls address the specific risk. These controls should leave evidence that the check occurred. GAO, Federal Information System Controls Audit Manual
- Require an independent approval before a transaction is entered.
- Have another person review posted transactions or relevant reports.
- Increase supervision or monitor activity associated with the conflict.
- Use an additional approval level where it meaningfully addresses the risk.
Document the conflict, the control chosen to reduce its risk, who performs that control, and evidence of completion. A nominal review that is not independent, does not examine the relevant activity, or leaves no record may not provide a useful check.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
