Resources
Segregation of Duties Review Services: Who Offers Them and How Do They Differ?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Your auditor asks for a segregation of duties review. Who offers one, and how do you compare them?
Three kinds of companies offer segregation of duties review services: consultants, software vendors and technology-enabled diagnostic services. Your own team is a fourth option. They differ in who runs the analysis, what your team owns, how you pay and how fast you get results. SOD Check from A2Q2 is a technology-enabled diagnostic service: software does the analysis, experienced practitioners review it, and you pay a fixed price per run, not for a license. No option decides the risk for you. Management does.
Which companies offer segregation of duties review services?
| Type | Who runs the analysis | Examples | Read next |
|---|---|---|---|
| Consultants and advisory firms | The firm, with your team | Many firms offer this. Scope and method vary. | What Can You Do Instead of Buying SOD Software? |
| Software vendors | Your team, using licensed software | Delinea Fastpath, Netwrix Strongpoint | Delinea Fastpath, Netwrix Strongpoint or A2Q2 SOD Check? |
| Technology-enabled diagnostic services | The service’s software analyzes your data. Experienced practitioners review the results. | SOD Check from A2Q2 | Where does SOD Check fit? (below) |
| Your own team | Finance, controls and systems staff | Reports, rules, workbooks or tools you build | What Can You Do Instead of Buying SOD Software? |
These are ways to organize the work, not a ranking.
How do the options differ?
| Question | Licensed software | Consultant | SOD Check (technology-enabled diagnostic service) |
|---|---|---|---|
| Who runs the analysis? | Your team operates the tool | The consultant, with your team | A2Q2’s software analyzes. Experienced practitioners review the results. |
| How do you pay? | A license | Set in the agreement | Fixed price per run. No license. |
| Does it watch access all year? | Depends on setup | Depends on the agreement | No. It is a point in time diagnostic. |
| What does your team manage? | Setup, rules, upkeep, results and records | Scope, source data, oversight and decisions | Exporting the reports, reviewing results and recording decisions |
| How fast are results? | Depends on setup and use | Depends on the agreement | SOD Check guarantees results within 10 business days after we receive the required documents. |
| What do you receive? | Tool output your team must judge | Agreed project deliverables | A finished set of results. Potential conflicts are ranked High or Medium. |
A diagnostic service can save you from running SOD software yourself. It does not remove management’s job of understanding the results. A potential conflict does not prove fraud, unauthorized activity or a failed control. Management weighs the process, the risk and the safeguards.
Which option fits your company?
1. Your own team fits a small scope, when staff have the time, data access and skill to build and read the analysis.
2. A consultant fits a complex process that needs advice made for you.
3. Licensed software fits a company that wants to watch access all year and has the staff to set up and run the tool.
4. A technology-enabled diagnostic service fits a company that wants a clear, reviewed answer at a point in time, paid at a fixed price per run, without running software.
If you use more than one system, ask each provider whether it can find conflicts for the same person across them. Do not assume it can.
Free resource: compare your SOD review options
The How to Compare Segregation of Duties Review Options checklist lets you ask every provider the same questions about scope, data, responsibilities, evidence and timing.
Which guide answers your next question?
1. How often do you need results? Read Continuous Monitoring or a Periodic Segregation of Duties Diagnostic?
2. Are you weighing named software? Read Delinea Fastpath, Netwrix Strongpoint or A2Q2 SOD Check?
3. Do you want all four options, seven questions to ask and a worked example? Read What Can You Do Instead of Buying SOD Software?
4. Do providers use review, analysis and assessment to mean different things? Read Segregation of Duties Review, Analysis, Assessment and Diagnostic: What Is the Difference?
5. How is this different from a user access review? Read Access Review vs User Access Review vs Segregation of Duties Review.
Each guide answers a different question. This page gives you the overview.
Where does SOD Check fit?
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change.
It is technology and human review together. It is not a team of consultants working by hand, and it is not software your company has to license, install or run. You pay a fixed price per run. SOD Check is not a full user access review, a SOX audit or an access fix. System owners approve changes, and your authorized system staff make them.
Frequently asked questions
Is SOD Check software or a service?
SOD Check is a technology-enabled segregation of duties diagnostic service provided by A2Q2. Our software analyzes the data, and experienced practitioners review the results. You pay for the diagnostic service per run. You do not license, install or operate the software yourself.
Is there one best provider?
Not for every company. Compare who runs the analysis, how you pay, how often you need results, what evidence you receive and what your team must do.
Can we outsource a segregation of duties review?
Yes. A consultant or a diagnostic service can do the analysis. Management still assesses the results and decides what to do.
Do I need a different provider for each system?
Not always. Ask each provider which systems it covers and whether it can look at the same person across them.
Your next step
Pick one process, such as vendor setup and payments. Write down the systems involved, how often you need results and who will assess them. Then use the checklist to compare your options on the same questions.
Top internal controls and SOX education for growing companies.