Segregation of Duties Analysis: Find Where One Person Has Too Much Control
Could one person create a vendor, change its bank details, and approve the payment?
SOD Check shows where one person may have too much access in NetSuite, Workday, Rippling, ADP, and other finance and HR systems. Our software does the analysis. Experienced practitioners review the results. You decide what to change and write down why.
We are so confident in the results you receive that you get three guarantees.
If you are not satisfied with your SOD Check, you get your money back.
If you find a potential access conflict we missed, that run is free.
Results within 10 business days after we receive the required documents.
- No software to buy or implement
- No direct access to your systems
- A service of A2Q2
Supported systems
- NetSuite
- Workday
- Zip
- Coupa
- Tipalti
- Rippling
- ADP
- E*TRADE
- Shareworks
- Salesforce
- Cross-System
- Integrated systems
What is SOD Check?
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. Some people call it a review, an analysis or an assessment. You get a ranked list of potential conflicts, recommended fixes, and the evidence behind every number. There is nothing to install.
Where can I start for free?
Here are free resources to download. The checklist helps you choose between your own team, a consultant, a service or software. The guide What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis walks you through all five steps. Not sure which reports to run? Short guides show each click. All are free, with or without SOD Check.
How to Compare Segregation of Duties Review Options
Choosing between your own team, a consultant, a service or software? Ask each the same 11 questions and compare the answers in one place. Free download.
What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis
One guide to the five steps, from capturing data to keeping a record of decisions. Free.
Worksheets for each step
One short worksheet per CHECK step, to use with your team.
Report guides
How to run the Manage Users report (who holds which roles) and the Show Role Differences report (what each role can do) in NetSuite, and the Security Group Assignments report in Workday. Where to click, and how to save them. Free downloads.
What is the SOD Check Method?
The SOD Check Method is a five-step way to work through potential segregation of duties conflicts. The steps are Capture Data, Highlight Conflicts, Examine Results, Confirm Safeguards, and Keep a Record of Decisions. We use it on every diagnostic. You can too.
Capture Data
What users, roles, permissions, and other information exist?
Highlight Conflicts
Where could one person have too much control?
Examine Results
What wrong action could the access allow, and could it go unchecked?
Confirm Safeguards
Is the access needed, and what safeguards surround it?
Keep a Record of Decisions
What did management review, decide, and document?
A potential conflict does not always mean access must be removed. Management decides and writes down why.
What should I do when my auditor asks for a segregation of duties analysis?
Show who can do what in your systems today. Show that the system data is complete and accurate. Show how management reviewed the results and decided what to do. SOD Check helps with all three. Evidence on data completeness and accuracy comes with Premium. SOD Check guarantees results within 10 business days after we receive the required documents.
A financial statement audit is often when this becomes urgent. Your auditor may ask:
- Who can do what in your financial systems today?
- How do you know the system data is complete and accurate?
- How did management review what was found, and what did it decide?
SOD Check is built for that request:
Have an audit deadline? Tell us when your auditor needs the analysis. We will tell you what it takes to meet it.
A current analysis, fast.
A current picture of who can do what, built from your own system data.
Every number traced to its source.
The Chain-of-Evidence Workbook links each summary number to the system data behind it. Your team can check the results and walk your auditor through them.
Evidence on data completeness and accuracy.
Premium adds evidence, prepared by our team, to support management’s view that the system reports behind the analysis are complete and accurate. Auditors often test this.
A clear path for management.
Potential conflicts are ranked High or Medium. You get recommended fixes and the SOD Check Method to write down what management reviewed and decided.
What is segregation of duties, and what does too much access look like?
Segregation of duties means no one person has unchecked control over a transaction from start to finish. Too much access looks like one person who can create a vendor and also approve the payment. Each permission can look fine alone. The risk shows up when they are combined.
| Business area | What could go wrong |
|---|---|
| Vendors | One person could create a vendor that should not exist, or change a real vendor’s bank details, and approve the payment. |
| Purchasing | One person could create the wrong purchase and approve it. |
| Payroll | One person could change an employee’s pay details and approve that payroll. |
| Accounting | One person could create or change a journal entry and approve or post it. |
| Administrator access | Someone got administrator rights for a project and still has them. They could change users, permissions, or settings with no check. |
Access also drifts. People join, leave, and change jobs. Roles get redesigned. Systems get reconfigured. Administrator rights given for a one-time need often stay in place. Access that made sense last year may not fit today.
These examples show what a combination of access could allow. A potential conflict is not proof that anything went wrong. It tells you where to look.
How does SOD Check work?
Your administrator exports user, role, and permission data using our instructions. Our software analyzes it the same way on every run. Experienced practitioners review the results. You decide what to change and write down why. SOD Check guarantees results within 10 business days after we receive the required documents.
You export.
We send your administrator system-specific instructions. They export your user, role, and permission data. For some systems, that is a few standard reports. For others, it is a report built from our instructions, and we tell your administrator exactly which fields to include. We never log into your systems.
We analyze and review.
Our proprietary software analyzes your users, roles, and permissions systematically, the same way on every run, so results do not depend on who happens to do the work. Experienced SOX practitioners then review the results using the SOD Check method as an extra safety check before anything is delivered
You decide.
You receive the completed diagnostic and the SOD Check method to work through it. Management reviews the business context and decides what, if anything, to change.
Need it sooner? Five business day delivery is available for an expedited price, subject to capacity.
Your information. Our technology and review. Your decision.
When should I run SOD Check, and which package do I need?
Run one when an auditor asks, a system changes, people or permissions change, you spot broad access, you prepare for an IPO, or it is time for a regular review. Essential gives a current view. Pro adds a comparison with your last run. Premium adds audit evidence and executive reporting.
Common reasons to take a fresh look
- Your auditor asked for a current segregation of duties analysis.
- A new system went live, or an existing one was reconfigured.
- People, roles, or permissions changed.
- You spotted broad access, administrator access, or another concern.
- You are preparing for an IPO or public-company rules.
- It is time for your regular review.
These are reasons to look. They are not signs that a problem exists.
Choose the level of support you need
Each package is a fixed price per system, per run. Not sure which fits? Start with your question. Where do we stand today? Essential. What changed since your last run? Pro. What will our CFO, Audit Committee and auditor need? Premium. Or tell us what prompted the review. We will recommend a package and share pricing once we understand your scope.
See the packages and what each one includes
Common Questions
Segregation of duties means separating tasks so no one person has unchecked control over a transaction from start to finish. For example, the person who creates a vendor should not also approve the payment to that vendor.
It is a service powered by our own software, with results reviewed by experienced practitioners. You buy the finished diagnostic, not a software license. There is nothing for your team to set up or run. The SOD Check Method is yours to keep.
SOD Check guarantees results within 10 business days after we receive the required documents. We also stand behind the work with two guarantees: not satisfied, your money back; missed a conflict, that run is free. Expedited 5-business-day delivery is available for an additional fee, subject to capacity.
NetSuite, Workday, Zip, Coupa, Tipalti, Rippling, ADP, E*TRADE, Shareworks, and Salesforce. If your system is not listed, ask us. We can scope a custom diagnostic.
Your administrator exports user and permission data by following our instructions. For NetSuite, that is two standard reports, saved as CSV or Excel files, with a screenshot of each.
You upload your exports to a secure shared folder. It is either one your company controls or one SOD Check provides on a Microsoft-hosted platform. Only the engagement team assigned to your diagnostic can open it. Your signed contract includes an NDA. We keep customer data for one year. We never access your systems.
No. It means the access could allow it. Management looks at the context before deciding if anything needs to change. That includes responsibilities, workflows, work done outside systems, and other safeguards.
Yes. Companies often run SOD Check because an auditor asked for a segregation of duties analysis. Premium adds completeness, accuracy, and data-integrity evidence for the system reports used. Auditors look for this kind of evidence when they rely on company-produced information. Your external auditor decides if the evidence is enough.
Yes. SOD Check shows where the conflicts are, rates them, and recommends fixes for management to weigh. Run it again after changes to see what improved. SOD Check does not fix anything for you. Any broader help needs a scope we agree on in writing.
No. It finds potential conflicts and recommends options. Management decides. Your authorized team makes the changes.
No. Segregation of duties looks at conflicting responsibilities or access. A user access review asks whether access is right for the job more broadly.
It can help. The results may show users with administrator or other broad access they do not need. Moving them to a lower-cost license may be possible. Savings depend on your system and your license agreement.
Yes. A later diagnostic shows what improved after your changes. Pro compares two runs side by side.