Resources
What Can You Do Instead of Buying SOD Software?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
You have four ways to review segregation of duties: do it with your own team, hire a consultant, use a diagnostic service, or buy software. Each one puts the work in a different place. Pick by three things: how much hands-on skill your team has, how well your team knows which duties to split, and how many systems the review must cover.
What problem are we trying to solve?
Picture a payroll specialist who can change pay rates and approve the payroll that pays them. A wrong rate could go out with no second check. The specialist may be careful and honest. The risk is in the combination.
The Controller needs to know who has the combination, whether a safeguard covers it, and what management should do. A spreadsheet, a consultant and a software product all support that work. None makes the decision for management.
Think of checking the locks in a building. You could make a list yourself, hire an inspector, or install a system that checks the doors. First decide what you need to know, and how often.
How do the four options compare?
| Option | Who does the work | What your company needs | What to watch |
|---|---|---|---|
| Your own team | Your staff pull the data, apply rules and record results | Time, hands-on skill with the systems, and someone who knows which duties should be split | Hard to repeat if one person holds the know-how. Data and rules can be incomplete |
| Consultant-led review | A firm reviews an agreed scope, using its own knowledge and methods | A clear scope. Facts from your team. Decisions from management | Scope and method vary a lot. Results depend on the consultant’s own knowledge, so they can differ from one consultant to the next. A broad controls project is not a focused access review. Compare like with like |
| Diagnostic service (SOD Check is one) | A provider uses technology to analyze the data, and a human practitioner reviews the results. It is not manual spreadsheets | Usable data from IT. Management to review results and record decisions | A point in time review. It does not watch access between reviews |
| Ongoing software | Your company runs the tool | Setup, rules, an owner for alerts, and a budget | A tool with no review owner does not solve the whole problem |
What should we look at beyond the options?
Five points separate the options. They are also where this page differs from the main build, buy or use guide at /products/compare.
| Point | Your own team | Consultant | Diagnostic service | Software |
|---|---|---|---|---|
| Hands-on skill your company needs | High | Low to medium | Low to medium | Medium to high |
| Expertise in which duties to split | Your team supplies it | Consultant may supply it | Provider and your team share it | Your team sets the rules |
| Coverage: one system, or across systems | Depends on the time you give it | Depends on the agreement | Depends on the data supplied | Depends on setup |
| Evidence you can keep | Whatever your team writes down | Ask what the report includes | Ask what comes back | Ask what the tool saves |
| Time to results after you buy | Depends on the time your staff can give it | Set in the agreement. Ask for a date | SOD Check guarantees diagnostic results within 10 business days after we receive your user access reports and permissions | Setup can take longer. Ask how long |
These ratings are general. They are not a test of any provider. Ask each one for specifics.
When could your own team do it?
It may work when the scope is small and staff know the systems and processes. A system administrator supplies the access data. Finance process owners explain which duties should be split. The hard part is making sure the data and the rules are complete. Ask one question: could another person on your team repeat this next year?
When could a consultant help?
It may help when you want outside experience or a tailored review. Ask which systems, dates, processes and evidence are in scope. Then compare offers that cover the same scope.
When could a diagnostic service help?
It may help when management needs a defined review without running a platform. SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Software analyzes your access data and experienced practitioners review the results. It identifies potential conflicts so management can examine results, confirm safeguards and record decisions. The Controller does not manage system permissions. IT or a system administrator supplies the data. Authorized staff make approved changes.
When could software help?
It may help when you need repeated checks and can run the process. Ask who gets the data, who keeps the rules, who looks at each alert and who records decisions.
Seven questions to ask every option
1. Which process and systems are in scope?
2. Do we need a point in time review or checks all year?
3. Who gets the data and checks it is complete?
4. Who examines the potential conflicts and the safeguards?
5. What evidence will management keep?
6. What will it cost, including our own staff time and repeat work?
7. How quickly can we get results after we buy?
A worked example
This example is an illustration, not a real company. The Controller picks one process, vendor setup and payments, and asks the seven questions of each option.
| Option | How the vendor setup and payments review might go |
|---|---|
| Your own team | An accounts payable lead and a system administrator pull the lists. The lead drafts the rules. Time is tight in the close. The Controller asks who could repeat it |
| Consultant | The firm reviews the agreed scope. The Controller checks that vendor setup and payments are named in it |
| Diagnostic service | IT sends the lists. The provider returns potential conflicts. The Controller examines the results and records decisions |
| Software | IT sets up the tool and names the rules. A person owns the alerts. The Controller reviews them each month |
The Controller does not pick the cheapest. The Controller picks the option that fits the team’s time, skill and need for a point in time answer or checks all year.
Frequently asked questions
Is the cheapest option best?
Not always. A low software price may still take many staff hours. A service fee still leaves management with decisions.
Can a spreadsheet be enough?
It can track access and decisions. But the file alone does not show the data is complete or the rules are right. Name the person who checks both.
Is this a full audit?
No. A segregation of duties review examines potential conflicts. It is not a full SOX audit or a full user access review.
Can I mix options?
Yes. For example, your own team might keep the decision log while a provider runs the analysis. Check for repeated work.
Your next step
This week, choose one process, such as vendor setup and payments. Name the business owner. Ask IT who can supply the access data. Then use the free How to Compare Segregation of Duties Review Options to compare the four options. You do not need to give an email address to get it.
Want to compare how often you need results? Read Continuous Monitoring or a Periodic Segregation of Duties Diagnostic? Want to compare named software? Read Fastpath, Strongpoint or SOD Check: What Is Different? The build, buy or use guide is at /products/compare.
Top internal controls and SOX education for growing companies.