Resources
Segregation of Duties Review, Analysis, Assessment and Diagnostic: What Is the Difference?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
A Controller asks for a segregation of duties review. IT calls it an access analysis. A vendor says assessment. Are these four different projects?
Not always. People use review, analysis and assessment loosely, and the work often overlaps. What matters is the question being answered. A review looks at who has what access. An analysis looks for access that may conflict. An assessment is management deciding what that means. SOD Check is a technology-enabled segregation of duties diagnostic service that identifies potential conflicts and reports results for management to consider.
What does each word mean?
| # | Word | What it means | Who does it |
|---|---|---|---|
| 1 | Review | Looking at who has which access and duties | Your team or a service |
| 2 | Analysis | Checking which mixes of access may conflict | Your team or a service |
| 3 | Assessment | Deciding how much a conflict matters, what safeguards exist and what to do | Your management team |
| 4 | Diagnostic | A structured check that identifies potential conflicts and reports results. SOD Check is one. | A service such as SOD Check |
These are plain meanings, not official categories. Companies mix the words, and so do we.
What does this look like during a close?
Picture a fictional company. One employee can both prepare and approve journal entries. The Controller wants to know if that person can finish both steps with no second check.
A review lists the employee’s access. An analysis may mark that pair as a potential conflict and call it a potential conflict for further review. Then management looks at the process. Is there a separate approval? Is there a record of review? Do other checks cover the risk?
The Controller or process owner then picks a path. Look closer. Ask for an access change. Add a safeguard. Or document why management considers the arrangement appropriate, including the safeguards it relied on. Authorized IT or system staff make any approved access change. The Controller does not.
A potential conflict is a reason to ask questions. It does not prove fraud, a bad journal entry or a failed control.
Where does SOD Check fit?
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. Your management team does the assessment. It looks at context and safeguards, decides what to do and writes down the decision.
SOD Check is not a full user access review, a SOX audit or ongoing monitoring service. If your duties span NetSuite and Workday, a separate cross-system analysis can follow once each system has its own diagnostic.
What should I ask for?
Start with the decision, not the label. Ask: can anyone do a mix of tasks that needs a closer look? What will management need to judge it? Then name the process and the systems. Decide who will supply the access data, who will analyze it and who will assess the results.
Frequently asked questions
Is a segregation of duties review the same as an assessment?
Many people use the words the same way. Here, a review looks at access. An assessment is management judging what it means.
Does a diagnostic say whether our controls work?
No. It identifies potential conflicts in the access analyzed. Management checks the process, safeguards and evidence before deciding what it means.
What if one person has access in two systems?
That is not automatically a conflict. A separate cross-system analysis can look at the combined access, after each system has its own diagnostic.
Related reading: Access Review vs User Access Review vs Segregation of Duties Review: What Is the Difference?
Next step: Write down one process and two duties you want kept apart. Use that to start a talk with your process owner and system administrator.
Want to keep reading?
Top internal controls and SOX education for growing companies.