Segregation of Duties Analysis: Find Where One Person Has Too Much Control
Could one person create a vendor, change its bank details, and approve the payment?
SOD Check shows where one person may have too much access in NetSuite, Workday, Rippling, ADP, and other finance and HR systems. Our software does the analysis. Experienced practitioners review the results. You decide what to change and write down why.
We are so confident in the results you receive that you get three guarantees.
Guarantee 1
Not satisfied? Your money back.
If you are not satisfied with your SOD Check, you get your money back.
Guarantee 2
Missed a conflict? That run is free.
If you find a potential access conflict we missed, that run is free.
Guarantee 3
Fast. Results in 10 business days.
Counted from the day we receive the required documents.
- Used by public and pre-IPO companies for 15+ years
- No software to buy or implement
- No direct access to your systems
What is SOD Check?
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. Some people call it a review, an analysis or an assessment. You get a ranked list of potential conflicts, recommended fixes, and the evidence behind every number. There is nothing to install.
Supported systems
Where can I start for free?
Start with the free downloads. There is a checklist to compare your options, a guide to all five steps, a worksheet for each step, and short walkthroughs for the reports you will need. All free, with or without SOD Check.
What is the SOD Check Method?
The SOD Check Method is a five-step way to work through potential segregation of duties conflicts. The steps are Capture Data, Highlight Conflicts, Examine Results, Confirm Safeguards, and Keep a Record of Decisions. We use it on every diagnostic. You can too.
Capture Data
What users, roles, permissions, and other information exist?
Highlight Conflicts
Where could one person have too much control?
Examine Results
What wrong action could the access allow, and could it go unchecked?
Confirm Safeguards
Is the access needed, and what safeguards surround it?
Keep a Record of Decisions
What did management review, decide, and document?
A potential conflict does not always mean access must be removed. Management decides and writes down why.
What should I do when my auditor asks for a segregation of duties analysis?
Show who can do what in your systems today. Show that the system data is complete and accurate. Show how management reviewed the results and decided what to do. SOD Check helps with all three. Evidence on data completeness and accuracy comes with Premium. SOD Check guarantees results within 10 business days after we receive the required documents.
A financial statement audit is often when this becomes urgent. Your auditor may ask:
- Who can do what in your financial systems today?
- How do you know the system data is complete and accurate?
- How did management review what was found, and what did it decide?
SOD Check is built for that request:
Have an audit deadline? Tell us when your auditor needs the analysis. We will tell you what it takes to meet it.
A current analysis, fast.
A current picture of who can do what, built from your own system data.
Every number traced to its source.
The Chain-of-Evidence Workbook links each summary number to the system data behind it. Your team can check the results and walk your auditor through them.
Evidence on data completeness and accuracy.
Premium adds evidence, prepared by our team, to support management’s view that the system reports behind the analysis are complete and accurate. Auditors often test this.
A clear path for management.
Potential conflicts are ranked High or Medium. You get recommended fixes and the SOD Check Method to write down what management reviewed and decided.
What is segregation of duties, and what does too much access look like?
Segregation of duties means no one person has unchecked control over a transaction from start to finish. Too much access looks like one person who can create a vendor and also approve the payment. Each permission can look fine alone. The risk shows up when they are combined.
| Business area | What could go wrong |
|---|---|
| Vendors | One person could create a vendor that should not exist, or change a real vendor’s bank details, and approve the payment. |
| Purchasing | One person could create the wrong purchase and approve it. |
| Payroll | One person could change an employee’s pay details and approve that payroll. |
| Accounting | One person could create or change a journal entry and approve or post it. |
| Administrator access | Someone got administrator rights for a project and still has them. They could change users, permissions, or settings with no check. |
Access also drifts. People join, leave, and change jobs. Roles get redesigned. Systems get reconfigured. Administrator rights given for a one-time need often stay in place. Access that made sense last year may not fit today.
These examples show what a combination of access could allow. A potential conflict is not proof that anything went wrong. It tells you where to look.
How does SOD Check work?
Your administrator exports user, role, and permission data using our instructions. Our software analyzes it the same way on every run. Experienced practitioners review the results. You decide what to change and write down why. SOD Check guarantees results within 10 business days after we receive the required documents.
You export.
We send your administrator system-specific instructions. They export your user, role, and permission data. For some systems, that is a few standard reports. For others, it is a report built from our instructions, and we tell your administrator exactly which fields to include. We never log into your systems.
We analyze and review.
Our proprietary software analyzes your users, roles, and permissions systematically, the same way on every run, so results do not depend on who happens to do the work. Experienced SOX practitioners then review the results using the SOD Check method as an extra safety check before anything is delivered
You decide.
You receive the completed diagnostic and the SOD Check method to work through it. Management reviews the business context and decides what, if anything, to change.
Need it sooner? Five business day delivery is available for an expedited price, subject to capacity.
Your information. Our technology and review. Your decision.
When should I run SOD Check, and which package do I need?
Run one when an auditor asks, a system changes, people or permissions change, you spot broad access, you prepare for an IPO, or it is time for a regular review. Essential gives a current view. Pro adds a comparison with your last run. Premium adds audit evidence and executive reporting.
Common reasons to take a fresh look
- Your auditor asked for a current segregation of duties analysis.
- A new system went live, or an existing one was reconfigured.
- People, roles, or permissions changed.
- You spotted broad access, administrator access, or another concern.
- You are preparing for an IPO or public-company rules.
- It is time for your regular review.
These are reasons to look. They are not signs that a problem exists.
Choose the level of support you need
Each package is a fixed price per system, per run. Not sure which fits? Start with your question. Where do we stand today? Essential. What changed since your last run? Pro. What will our CFO, Audit Committee and auditor need? Premium. Or tell us what prompted the review. We will recommend a package and share pricing once we understand your scope.
See the packages and what each one includes
Common questions
What SOD Check is, what your team provides, how your data is handled, and whether a potential conflict means something went wrong.