Systems
Cross-System Segregation of Duties Analysis
Can one person have conflicting access across NetSuite and Workday?
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Software analyzes your access data and experienced practitioners review the results. It can analyze the same person’s access across NetSuite and Workday. Our cross-system diagnostic brings the system results together to identify potential conflicts. Management assesses the risk, considers safeguards, and decides what to do. A cross-system analysis does not replace a full user access review or prove that a control failed.
Each system in scope needs its own SOD Check diagnostic first. The cross-system work has a separate scope.
Watch the cross-system demo and walkthrough
Two short videos. The product demo shows how a cross-system analysis works. The walkthrough shows the files you receive.
Cross-system analysis: product demo
See how one analysis covers the same person across systems.
Cross-system analysis: walkthrough
Walk through the three files you receive and how to read them.
Which level of analysis do you need?
One-System Analysis
A one-system diagnostic looks at users, roles, permissions, and potential conflicts in one supported system.
For example, a NetSuite analysis can show access that may conflict within NetSuite.
Choose this when the duties you need to analyze sit in one system.
Cross-System Analysis
A cross-system diagnostic brings the results from each completed system diagnostic together. It looks for conflicts you may miss when you analyze each system alone. The exact data and deliverables are set in the agreed scope.
For example, a Controller may need to know what one person’s access in Workday and NetSuite could allow them to do.
Each system in scope needs its own completed SOD Check diagnostic first. The cross-system analysis is scoped separately.
Integrated Analysis
Some duties sit outside a system. For example, a person may approve a payment by email or sign a paper check.
An integrated diagnostic looks at system access and those off-system duties together. It can cover one system or more. First, complete the diagnostic for each system in scope and a manual-process diagnostic of the off-system duties.
Management checks the safeguards and decides whether to act.
Why does combined access matter?
A Workday analysis may show one part of an employee’s duties.
A NetSuite analysis may show another.
The Controller needs to know whether those duties, when held by one person, create a risk worth a closer look.
A cross-system analysis helps the team answer that question.
It does not prove that a wrong payment was made or a control failed. It does not mean an auditor will accept the results.
How should management assess duties across both systems?
Example: a person can maintain employee pay information in Workday and also record payroll-related journal entries in NetSuite. Management would check whether the actual access and process permit incompatible steps, whether another person approves changes or reconciles payroll, and whether those safeguards work. Holding both responsibilities does not by itself establish a conflict.
Management may change access, add a check, look into the issue, or record why the current setup is right for the job.
How does analysis lead to action?
A useful analysis does more than list access that may conflict.
It helps management work through a decision:
Collect access → Analyze potential conflicts → Assess risk and safeguards → Decide next steps → Document decisions
A potential conflict does not prove fraud, a loss, or a failed control.
Controllers and process owners decide what to do about the risk. System owners approve system changes. Authorized IT and system staff make those changes.
Want to do the Cross-System segregation of duties analysis yourself?
Here are free workbooks you can fill in for yourself.
A sample shows what the workbooks look like. It does not show your results. Your external auditor decides what evidence is enough for the audit.
Which type of analysis do you need?
| Your situation | Scope to discuss |
|---|---|
| One system | Consider an analysis of that system. |
| Two or more systems | Consider cross-system analysis once each system’s diagnostic is complete. |
| Systems plus off-system duties | Discuss an integrated diagnostic and the work needed first. |
| Not sure | Start with the systems, process, and duties that concern you. A2Q2 can help you work out the scope. |
See the NetSuite analysis and Workday analysis pages for system-specific preparation.
We are so confident in the results you receive that you get three guarantees
If you are not satisfied with your SOD Check, you get your money back.
If you find a potential access conflict we missed, that run is free.
Results within 10 business days after we receive the required documents.
Buyer questions
What is a segregation of duties analysis? An analysis checks whether one person has duties or access that may conflict. SOD Check looks at access and highlights combinations for management to examine.
How is a segregation of duties analysis performed? We use the agreed system data to look for access that may conflict. This includes users, roles, and permissions. Our software does the analysis. Experienced practitioners review the results before they are delivered to you. Management then weighs what they mean.
What does a segregation of duties assessment help management decide? It helps management weigh the risk, check safeguards, and decide whether to look further or change access or a process.
Can an analysis identify conflicts across NetSuite and Workday? Yes. A cross-system diagnostic can look at combined access after each system has its own completed SOD Check diagnostic.
Do we need software or a segregation of duties analysis service? That depends on the scope, how often you need results, who will do the work, and cost. SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2, scoped per system and run. Software analyzes your access data and experienced practitioners review the results. Software can fit a company that wants to run continuous monitoring itself. With SOD Check you do not install or run a platform.
Does a potential conflict mean a control failed? No. A potential conflict is something for management to examine. It does not, by itself, prove fraud, a wrong transaction, or control failure.