Resources
Access Review vs User Access Review vs Segregation of Duties Review: What Is the Difference?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
A manager approves an employee’s system access. Does that mean the same employee should be able to prepare and approve a payment? Not always. One approval can answer one question and miss the other.
“Access review” is a broad term for checking who can get into a system. A user access review typically asks if each person’s access still fits their job. A segregation of duties review asks if some access, held together, lets one person do too much. The reviews can overlap, but one does not automatically answer the other.
What is the difference between the three reviews?
| # | Review | The question it asks | Who decides |
|---|---|---|---|
| 1 | Access review (broad term) | Who has access, and what can they do? | Depends on the purpose |
| 2 | User access review | Does each person still need this access? | Managers or system owners decide. Authorized IT or system staff supply the data. |
| 3 | Segregation of duties review | Should one person hold these duties together? | Management. A team or a service can do the analysis. |
What does a user access review do?
Many companies ask managers or system owners to check access on a schedule. They look at who can use an application, what roles they hold and whether those roles still fit the job. How often, and how deep, depends on the company’s risks and policies.
A system administrator or authorized IT person can pull the user and role reports. The reviewer decides if each person’s access is right and records the decision. Authorized system staff then make any approved changes. The company keeps the evidence.
What can it miss?
Picture a fictional accounts payable employee. Two of their permissions could let them create a vendor and start a payment. A manager might see each permission as fair on its own. Together, they raise another question: is there an independent approval before money leaves the company?
A well-built user access review may already check for this. It does not have to look at roles one at a time. But a sign-off that access is still needed does not show that duty conflicts were checked.
What does a segregation of duties review add?
It looks at access in combination. It can identify potential combinations of access that may let one person do tasks that should be split or checked by someone else. The result is a possible conflict to look into. It does not prove a bad payment or a failed control.
Management then looks at what the person can really do and how the process works. Are there independent approvals or reconciliations? Is more action needed? The Controller or process owner decides. Authorized IT or system staff make any approved access change.
Do we need both?
That depends on your systems, risks and control needs. Many companies want both answers. Is each person’s access appropriate? And does a combination of access warrant closer review or added safeguards? One process can cover both if its scope and evidence really do. Do not assume one review covers the other.
Where does SOD Check fit?
SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Your administrator exports user, role and permission data. Our software analyzes it, experienced practitioners review the results, and you decide what to change. Management then judges what they mean, looks at safeguards and decides what to do. SOD Check is not a full user access review. Your authorized system staff make any access changes.
Frequently asked questions
Can a user access review find duty conflicts?
Yes, if it checks the right combinations and records the result. A simple “still needed” sign-off may not.
Who removes access after a review?
Authorized IT or system staff make approved changes. Managers or system owners decide if access is right. Management owns the business risk decision.
Does a potential conflict prove a control failed?
No. It is a reason to check real permissions, process steps, safeguards and evidence.
Related reading: Segregation of Duties Review, Analysis, Assessment and Diagnostic: What Is the Difference?
Next step: Ask for your latest user access review scope and evidence. Check if it looked at access that may conflict, who judged it and how the decision was recorded.
Want to keep reading?
Top internal controls and SOX education for growing companies.