Systems
Zip Segregation of Duties Review
Your Zip approval flows may look right on paper. What happens when one person can create a purchase request and also approve it?
Zip often sits at the front of your spend process. If one person can start a request, approve it and change the approval rules, nobody else may see the spend before it is committed. SOD Check shows where one person’s access could give them too much control over one purchasing step. Experienced practitioners review the results.
SOD Check has been used by public and pre-IPO companies for 15+ years · No software to buy or implement · No direct access to your Zip · A service of A2Q2
A2Q2 has helped 30+ public companies strengthen controls, 17 before their IPO.
What is a Zip segregation of duties review?
It checks who has what access in Zip and finds combinations that may give one person too much control. An example is a user who can edit approval workflows and also approve requests that follow those workflows. SOD Check ranks each potential conflict High or Medium and suggests fixes for management to weigh. A potential conflict does not prove anything went wrong. It shows where to look.
People also call this a Zip segregation of duties analysis or assessment. The terms mean the same thing on this page.
What does the Controller need to decide?
Decide whether the people who build and change approval rules are kept apart from the people who approve spend. Also decide who may add or change suppliers and payment details that flow on to your payables system.
How does access work in Zip?
Users hold roles and permissions that decide what they can request, approve, configure and administer. Administrators can also change workflows and integrations. Each one is fine alone. The risk is in the combination.
Which processes does it cover?
Purchase requests, approvals, workflow and policy setup, supplier onboarding and administrator functions.
What will you receive?
A ranked list of potential conflicts, the people and roles behind each one, suggested fixes, and a workbook you can hand to your external auditors or internal audit team. We do not tell auditors what to conclude.
- A current picture, fast. Results are guaranteed within 10 business days after we receive the required documents.
- Every number traced to its source. Your team can check the results and walk your auditor through them.
- Support for your auditor’s questions. Premium adds checks by our team on the Zip data behind the analysis, including its completeness and accuracy.
- A clear path for management. You get recommended fixes and the SOD Check Method to write down what management decided.
Have a deadline? Tell us when your auditor needs the results. We will tell you what it takes to meet it.
What does our Zip administrator need to do?
Your Zip administrator runs the standard user and role reports and uploads them to a secure folder. We never log in to Zip. We confirm the exact reports with your administrator when you book.
What does SOD Check look at in Zip?
Role and permission combinations across request, approval, workflow setup, supplier setup and administration.
What if responsibilities go beyond Zip?
A person may be clean in Zip but hold conflicting access in your ERP or payables tool. A Cross-System review looks at all of them together. See the Cross-System analysis.
When should we run a Zip review?
Before your first SOX year, after you switch on new approval flows, when you add an integration to your ERP, or before an audit asks.
Which package should we choose?
Each package is a fixed price per system, per run. Choose by the question your team needs answered. We share pricing once we understand your scope.
We are so confident in the results you receive that you get three guarantees
If you are not satisfied with your SOD Check, you get your money back.
If you find a potential access conflict we missed, that run is free.
Results within 10 business days after we receive the required documents.
See what each package includes on the Products page.
Need it sooner? Expedited 5-business-day delivery is available for an additional fee, subject to capacity. See how the packages compare.
Who is behind SOD Check?
Top internal controls and SOX education for growing companies. SOD Check is a service of A2Q2, a SOX and internal controls firm. A2Q2 has helped 30+ public companies strengthen controls, 17 before their IPO.
Kim Le, top internal controls and SOX educator | Former public company audit committee chair | Helped 40+ public companies strengthen controls, 19 before their IPO.
Kim Le designed SOD Check. She is a CPA and CIA with more than 30 years of public accounting experience serving public and private companies.
SOD Check has been field-tested and used for more than 15 years. It has run as a methodical, systematic diagnostic since 2011. Experienced practitioners review every diagnostic.
Zip questions
Do you need access to our Zip?
No. Your administrator runs standard reports and uploads them.
What Zip information do we provide?
User, role and permission reports from Zip.
What if our approval workflow blocks self-approval?
SOD Check still lists who can change that workflow, because a workflow can be edited.