Segregation of Duties Review: Find Where One Person Has Too Much Control
Could one person create a vendor, change its bank details, and approve the payment?
SOD Check shows where one person may have too much access in NetSuite, Workday, Rippling, ADP, and other finance and HR systems. Our software does the analysis. Experienced practitioners review the results. You decide what to change and write down why.
SOD Check guarantees results within 10 business days after we receive the required documents.
Two guarantees. We are confident in our work.
Not satisfied? Your money back. If you are not satisfied with your SOD Check, you get your money back.
Missed a conflict? It is free. If you find a conflict our diagnostic missed, that run is free.
Top internal controls and SOX education for growing companies.
Also:
Get the What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis
Book a Free 15-Minute Consultation
See sample results by system
Auditor asking for a segregation of duties analysis? See how SOD Check helps
Supported systems
- NetSuite
- Workday
- Zip
- Coupa
- Tipalti
- Rippling
- ADP
- E*TRADE
- Shareworks
- Salesforce
What is SOD Check?
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. Some people call it a review, an analysis or an assessment. You get a ranked list of potential conflicts, recommended fixes, and the evidence behind every number. There is nothing to install.
Where can I start for free?
Start with the free checklist to compare review options. It helps you choose between your own team, a consultant, a service or software, with no sign-up needed. The guide called What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis walks you through all five steps. Not sure which reports to run? Short guides show each click. All are free, with or without SOD Check.
How to Compare Segregation of Duties Review Options
Choosing between your own team, a consultant, a service or software? Ask each the same 11 questions and compare the answers in one place. Free download.
What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis
One guide to the five steps, from capturing data to keeping a record of decisions. Free.
Worksheets for each step
One short worksheet per CHECK step, to use with your team.
Report guides
How to run the Manage Users report (who holds which roles) and the Show Role Differences report (what each role can do) in NetSuite, and the Security Group Assignments report in Workday. Where to click, and how to save them. Free downloads.
What should I do when my auditor asks for a segregation of duties analysis?
Show who can do what in your systems today. Show that the system data is complete and accurate. Show how management reviewed the results and decided what to do. SOD Check helps with all three. Evidence on data completeness and accuracy comes with Premium. SOD Check guarantees results within 10 business days after we receive the required documents.
A financial statement audit is often when this becomes urgent. Your auditor may ask:
- Who can do what in your financial systems today?
- How do you know the system data is complete and accurate?
- How did management review what was found, and what did it decide?
SOD Check is built for that request:
Your external auditor decides what evidence is enough for the audit.
Have an audit deadline? Tell us when your auditor needs the analysis. We will tell you what it takes to meet it.
A current analysis, fast.
A current picture of who can do what, built from your own system data.
Every number traced to its source.
The Chain-of-Evidence Workbook links each summary number to the system data behind it. Your team can check the results and walk your auditor through them.
Evidence on data completeness and accuracy.
Premium adds evidence, prepared by our team, to support management’s view that the system reports behind the analysis are complete and accurate. Auditors often test this.
A clear path for management.
Potential conflicts are ranked High or Medium. You get recommended fixes and the CHECK Method to write down what management reviewed and decided.
Also: Book a Free 15-Minute Consultation · See sample results by system
In a free 15-minute call, we confirm your systems, the data your administrator needs, your timing, and next steps for a fixed quote.
What is segregation of duties, and what does too much access look like?
Segregation of duties means no one person has unchecked control over a transaction from start to finish. Too much access looks like one person who can create a vendor and also approve the payment. Each permission can look fine alone. The risk shows up when they are combined.
| Business area | What could go wrong |
|---|---|
| Vendors | One person could create a vendor that should not exist, or change a real vendor’s bank details, and approve the payment. |
| Purchasing | One person could create the wrong purchase and approve it. |
| Payroll | One person could change an employee’s pay details and approve that payroll. |
| Accounting | One person could create or change a journal entry and approve or post it. |
| Administrator access | Someone got administrator rights for a project and still has them. They could change users, permissions, or settings with no check. |
Access also drifts. People join, leave, and change jobs. Roles get redesigned. Systems get reconfigured. Administrator rights given for a one-time need often stay in place. Access that made sense last year may not fit today.
These examples show what a combination of access could allow. A potential conflict is not proof that anything went wrong. It tells you where to look.
What do I receive from SOD Check?
You receive Excel workbooks and slides your team already knows how to use. The Chain-of-Evidence Workbook shows the key results on one page. The Detailed Diagnostic Workbook lists every potential conflict, ranked High or Medium, with recommended fixes. Premium adds an executive summary for the CFO and Audit Committee.
The goal is not a bigger spreadsheet. It is a clear path from system access to investigation, decision, and evidence.
| File | What it gives you | Package |
|---|---|---|
| Chain-of-Evidence Workbook | Start here. One page shows the key results, such as users and roles analyzed and users with potential conflicts. Click any number to see the source evidence behind it, then click back. Controllers can check the results in minutes and explain them to executives and auditors. | Every package. Exhibits vary by package. |
| Detailed Diagnostic Workbook | The full analysis. Every potential conflict is ranked High or Medium. You see the users, roles, and permissions behind it, a plain explanation of what the access could allow, recommended fixes for management to weigh, and the source exhibits. | Every package. Reports vary by package. |
| CFO and Audit Committee Executive Summary | Slides with the headline results and trends across diagnostics, for the CFO, CEO, and Audit Committee. | Premium. Bonus with Pro. |
Why the results are easy to use
Familiar formats.
Excel workbooks and slides. No new software, logins, or training.
One page first.
The Chain-of-Evidence Workbook shows the whole picture on one page. Drill down only where you need to.
Ranked and plain.
High and Medium ratings put what needs attention first. Each conflict explains what the access could allow.
Who uses the results, and for what?
How does SOD Check work?
Your administrator exports user, role, and permission data using our instructions. Our software analyzes it the same way on every run. Experienced practitioners review the results. You decide what to change and write down why. SOD Check guarantees results within 10 business days after we receive the required documents.
You export.
We send your administrator system-specific instructions. They export your user, role, and permission data. For some systems, that is a few standard reports. For others, it is a report built from our instructions, and we tell your administrator exactly which fields to include. We never log into your systems.
We analyze and review.
Our proprietary software analyzes your users, roles, and permissions systematically, the same way on every run, so results do not depend on who happens to do the work. Experienced SOX practitioners then review the results using the CHECK method as an extra safety check before anything is delivered
You decide.
You receive the completed diagnostic and the CHECK method to work through it. Management reviews the business context and decides what, if anything, to change.
Need it sooner? Expedited 5-business-day delivery is available for an additional fee, subject to capacity.
Your information. Our technology and review. Your decision.
What is the CHECK Method?
The CHECK Method is a five-step way to work through potential segregation of duties conflicts. The steps are Capture Data, Highlight Conflicts, Examine Results, Confirm Safeguards, and Keep a Record of Decisions. We use it on every diagnostic. It is yours to keep, on any system.
Capture Data
What users, roles, permissions, and other information exist?
Highlight Conflicts
Where could one person have too much control?
Examine Results
What wrong action could the access allow, and could it go unchecked?
Confirm Safeguards
Is the access needed, and what safeguards surround it?
Keep a Record of Decisions
What did management review, decide, and document?
A potential conflict does not always mean access must be removed. Management decides and writes down why.
Our technology stays with SOD Check. The CHECK Method travels with you.
Get the What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis (free guide)
Read the blog series on the CHECK Method
Can SOD Check review more than one system?
Yes. Start with one system and add others. Many finance steps run across systems and by hand. One system alone may not show the whole picture. We can review one system, conflicts across systems, work done outside systems, or all of these together. Each system needs its own completed SOD Check diagnostic first. A cross-system review is scoped separately. We set the scope with you for each engagement.
For example, someone could change employee pay details in an HR system such as Workday, Rippling, or ADP. The same person could post payroll journal entries in NetSuite. Neither system shows the full picture alone.
Single-system review.
Conflicts inside one system.
Cross-system review.
Conflicts that span two or more systems.
Manual-process review.
Responsibilities done outside systems, such as approvals on paper or by email.
Integrated review.
System access and manual work seen together.
We agree on the systems and processes with you before work starts. A single-system diagnostic does not cover every system by default.
How does SOD Check compare with other ways to handle segregation of duties?
Most companies use spreadsheets in-house, software built for segregation of duties, or a consulting engagement. SOD Check is a finished diagnostic. Our software and practitioners do the analysis. You install nothing and maintain nothing. You export the reports and make the decisions.
| Spreadsheets in-house | Software | Consulting engagement | SOD Check | |
|---|---|---|---|---|
| Who does the analysis | Your team | Your team, using the tool | The consultant | Our software, plus practitioner review |
| How consistent it is | Depends on your team’s process and controls | Depends on configuration, rules and ongoing maintenance | Varies by engagement | Same method on every run. Practitioner review adds a safety check. |
| What you set up and maintain | Rules, workbooks, and the know-how to read them | License, setup, rules, mappings, and training | Scoping and oversight of a custom project | Nothing to install or maintain. You export the reports. |
| What you end up with | Your team’s own analysis | Tool output your team must interpret | A custom report | A finished diagnostic with recommended fixes for management to weigh, plus the CHECK Method |
When should I run SOD Check, and which package do I need?
Run one when an auditor asks, a system changes, people or permissions change, you spot broad access, you prepare for an IPO, or it is time for a regular review. Essential gives a current view. Pro adds a comparison with your last run. Premium adds audit evidence and executive reporting.
Common reasons to take a fresh look
- Your auditor asked for a current segregation of duties analysis.
- A new system went live, or an existing one was reconfigured.
- People, roles, or permissions changed.
- You spotted broad access, administrator access, or another concern.
- You are preparing for an IPO or public-company rules.
- It is time for your regular review.
These are reasons to look. They are not signs that a problem exists.
Choose the level of support you need
Each package is a fixed price per system, per run. Not sure which fits? Start with your question. Where do we stand today? Essential. What changed since your last run? Pro. What will our CFO, Audit Committee and auditor need? Premium. Or tell us what prompted the review. We will recommend a package and share pricing once we understand your scope.
Essential
A current-state diagnostic: potential conflicts within and between roles, prioritized High or Medium, the users, roles, and permissions behind them, recommended fixes, the Chain-of-Evidence Workbook, and the Detailed Diagnostic Workbook.
Best fit
Current-state clarity
Pro
Everything in Essential, plus a side-by-side comparison with your prior SOD Check, by role and by user, and the CFO and Audit Committee Executive Summary as a bonus. Requires a prior SOD Check run on the same system.
Best fit
See what changed since your last run. Run it as often as you need.
Premium
Everything in Essential, plus prior-run comparisons when history exists, administrator conflicts by user, the CFO and Audit Committee Executive Summary, completeness, accuracy, and data-integrity evidence prepared by our team, and a 30-minute consultation with a practitioner. Can be your first run.
Best fit
Executive reporting and audit support, plus current-state clarity and seeing what has changed over time.
Each package is a fixed price per system, per run. Not sure which fits? Tell us what prompted the review. We will recommend a package and share pricing once we understand your scope.
Common Questions
Segregation of duties means separating tasks so no one person has unchecked control over a transaction from start to finish. For example, the person who creates a vendor should not also approve the payment to that vendor.
It is a service powered by our own software, with results reviewed by experienced practitioners. You buy the finished diagnostic, not a software license. There is nothing for your team to set up or run. The CHECK Method is yours to keep.
SOD Check guarantees results within 10 business days after we receive the required documents. We also stand behind the work with two guarantees: not satisfied, your money back; missed a conflict, that run is free. Expedited 5-business-day delivery is available for an additional fee, subject to capacity.
NetSuite, Workday, Zip, Coupa, Tipalti, Rippling, ADP, E*TRADE, Shareworks, and Salesforce. If your system is not listed, ask us. We can scope a custom diagnostic.
Your administrator exports user and permission data by following our instructions. For NetSuite, that is two standard reports, saved as CSV or Excel files, with a screenshot of each.
You upload your exports to a secure shared folder. It is either one your company controls or one SOD Check provides on a Microsoft-hosted platform. Only the engagement team assigned to your diagnostic can open it. Your signed contract includes an NDA. We keep customer data for one year. We never access your systems.
No. It means the access could allow it. Management looks at the context before deciding if anything needs to change. That includes responsibilities, workflows, work done outside systems, and other safeguards.
Yes. Companies often run SOD Check because an auditor asked for a segregation of duties analysis. Premium adds completeness, accuracy, and data-integrity evidence for the system reports used. Auditors look for this kind of evidence when they rely on company-produced information. Your external auditor decides if the evidence is enough.
Yes. SOD Check shows where the conflicts are, rates them, and recommends fixes for management to weigh. Run it again after changes to see what improved. SOD Check does not fix anything for you. Any broader help needs a scope we agree on in writing.
No. It finds potential conflicts and recommends options. Management decides. Your authorized team makes the changes.
No. Segregation of duties looks at conflicting responsibilities or access. A user access review asks whether access is right for the job more broadly.
It can help. The results may show users with administrator or other broad access they do not need. Moving them to a lower-cost license may be possible. Savings depend on your system and your license agreement.
Yes. A later diagnostic shows what improved after your changes. Pro compares two runs side by side.
Find Where to Investigate
You do not need to pick a package or know which reports to run. Start with the free Side-by-Side Checklist. Or tell us what prompted the review, and we will recommend the right scope and next step. If your auditor is waiting, tell us your deadline.
Also:
Get the What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis