Resources
How Do I Know Whether a Control Reduces a Segregation of Duties Risk?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
A safeguard reduces a segregation of duties risk only if it fits the risk and really runs. Name the safeguard and say who owns it. Ask how it works, how often it runs, and what proof it leaves. A written policy shows the plan. A record from the right period shows it ran. The Controller decides whether it is enough. This is the Confirm Safeguards step.
Why does this step matter? Start with a picture.
Picture a sign on a door that says, “Always lock this door.” The sign is a rule. It does not tell you whether anyone locked the door last Tuesday. To know that, you need something more, like a log or a witness. A safeguard works the same way. The policy is the sign. The proof is what shows the door was locked.
Now picture a busy manager who is meant to review every payment. The manager means well. Month-end is hectic, and some weeks the review is skipped. Nobody did anything wrong on purpose. The plan was good. The proof is thin. This step helps you see the difference before you rely on the safeguard.
What is a safeguard?
A safeguard is a step that can help prevent or catch a problem when one user holds two jobs that are normally split. It does not always remove the risk. Its value depends on the process, the people, and how well the step works. Here are some examples.
| Safeguard (example) | What it might look like | Proof to ask for |
|---|---|---|
| Second approval | A manager approves payments above a set amount | A sign-off or approval record for the period |
| Independent review | A second person reviews journal entries | Review notes with dates and the reviewer’s name |
| Report review | A manager reviews a list of changes to vendor bank details | The report that was reviewed, and the sign-off |
| System limit | An amount limit stops one user from releasing large payments | A system report, from the system administrator, that shows the limit |
These are examples. Your company may use different ones.
What is the difference between a written control and a working control?
A written control says what should happen. A working control is one you can see happened. A policy may say a manager reviews payments. To know whether the review happened, ask for records from the period you are assessing. A sign-off, a review note, or a system record may help, depending on the control. A policy alone does not prove the control ran.
What proof should I ask for?
Start with four questions.
1. Who does the check?
2. How often?
3. What do they look at?
4. What record shows the check took place?
Then ask whether the record covers the transactions and dates in question. Also ask whether the checker is a different person from the user who did the work. A good file lets another reviewer see what happened without relying on a spoken explanation.
What if the proof is weak or missing?
Do not assume the safeguard failed because one file is missing. Ask the owner for the right proof. Write down the gap. If the team still cannot confirm the safeguard, record that limit plainly. The Controller can then decide whether the company needs more review, another safeguard, or a change to the user’s access. A system change goes through the system owner’s approval. Keep the reason for the decision.
Who decides whether the safeguard is enough?
| Person | Their part |
|---|---|
| Controller | Decides whether the safeguard is enough for the business risk, and writes down the reason. |
| Process owner | Explains how the check works and gathers the proof. |
| System administrator | Confirms any system limit and shows how it is set. |
| System owner | Approves any later change to the system. |
| Internal audit or SOX lead | May advise on what proof is usually expected. |
Do not hand the risk decision to IT just because the issue began with system access. IT explains the access. The Controller decides the risk.
What does this step not do?
This step looks at the proof you collect. It does not prove that a safeguard is effective for every period or every transaction. It does not change any access. It does not decide for you. This guide explains a review process. It is not an audit.
A worked example
This example is an illustration, not a real event. A finance specialist named Jordan can create and approve journal entries. A manager says a second person reviews every entry. The Controller asks for proof. The team checks three things. Is the reviewer a different person from Jordan? Does the review record cover the entries and dates in question? Does the record show review notes and not only a signature? The records cover about half the period. The team writes down what is missing and who will follow up. The Controller does not call the safeguard weak or strong yet. The status is “Evidence pending.”
Frequently asked questions
Can a safeguard replace a role change?
Sometimes it can reduce the risk. It is not an automatic substitute for splitting the duties. The Controller decides, with the proof in hand.
What if the check only ran part of the time?
Record the gap and the period it covers. Then ask the Controller to decide what happens next.
Does a system limit count as a safeguard?
It can. Ask the system administrator to show how the limit is set. Then ask whether the user can change it.
Who should be the reviewer?
A different person from the user who did the work. Ask whether the reviewer really looks at the details or only signs.
Does this step prove a control works?
No. It shows what proof exists and what does not. Any conclusion depends on the scope and the proof.
Your next step
This week, pick one item with a potential conflict that relies on a safeguard. Write down the safeguard, its owner, and the proof you have. Then use the free How to Check That a Control Reduces the Risk: Confirm Safeguards Worksheet to record the proof, the gaps, and the next action. You do not need to give an email address to get it.
Need the facts first? Read How Do I Tell Whether a Segregation of Duties Conflict Needs Action? New to the method? Start with How Do I Run a Segregation of Duties Review? Ready for the last step? Read the Keep a Record of Decisions guide.
Top internal controls and SOX education for growing companies.