Resources
Continuous Monitoring or a Periodic Segregation of Duties Diagnostic?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Ongoing monitoring watches access all year, but your company has to run it. A periodic diagnostic reviews access at a date you choose, and it can miss changes made between reviews. Neither one decides risk for you. Start with three facts: how often access changes, who would follow up on each potential conflict, and what evidence management must keep.
Why does this choice matter? Start with a picture.
Picture a payroll specialist who can change a pay rate and also approve the payroll that pays it. The specialist may be careful and honest. But a wrong pay rate could go out with no second person checking it. The Controller needs to know who has that combination, who will look into it, and what safeguard may cover it.
Now picture two companies. In one, jobs and access change every week. A review done in January says little about March. In the other, the team is steady, and management needs one clear answer before year-end. The two companies may need different tools for the same risk.
Think of a smoke alarm and a yearly fire inspection. The alarm watches all the time. The inspector looks closely on one day. Both only help if someone acts on what they find.
How do the two approaches compare?
| Question | Ongoing monitoring software | Periodic diagnostic (SOD Check is one) |
|---|---|---|
| How often does it look? | Repeated checks. How often depends on the software and its setup | Once, at a date or period you choose |
| Watching all year? | ✓ Yes, if your company runs it all year. How often depends on setup | ✗ No. It looks at the date you choose. It does not watch access between reviews |
| What can it miss? | Gaps in the rules, the data feed or the people reviewing alerts | Access changes made between reviews |
| Who runs it? | Your company configures it and runs it | A provider runs the analysis. Your company supplies data and makes decisions |
| What must your team own? | Rules, alerts, reviews and decisions, all year | Getting usable data, then reviewing results and recording decisions |
| What evidence can you keep? | Ask the vendor what is saved and how | Ask the provider what is saved and how |
| When may it fit best? | Access changes often, or you need recurring checks | You need a clear view at a set date without owning a platform |
Key: ✓ yes, ✗ no. Neither approach proves fraud or a control failure. A potential conflict is a question for management.
When does ongoing monitoring fit?
It may fit when access changes often or the company needs recurring checks. It works best when someone owns the work each month. That person keeps the rules current, looks at each alert, and writes down what was decided. An alert with no owner is just noise. Ask who will own it before you buy.
When does a periodic diagnostic fit?
It may fit when management needs a clear view at a chosen date, such as before a SOX walkthrough or a system change. SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Software analyzes your access data and experienced practitioners review the results. It identifies potential conflicts for management to examine. It is not a monitoring platform that your company runs. It does not watch access between reviews, and it does not remove permissions. Management examines the results, confirms safeguards and records decisions.
Who does what?
| Person | Their part |
|---|---|
| Controller or process owner | Explains the process. Decides what a potential conflict combination means for the business |
| IT leader or system administrator | Explains how often access changes. Runs the reports the review needs |
| System owner | Approves any change to the system |
| Internal audit or SOX lead | May advise on what evidence is expected |
Five questions to ask before you choose
1. How often does access change in the systems that handle payments, payroll and journal entries?
2. Do we need one answer at a set date, or checks all year?
3. Who will look into each potential conflict, and how many hours a month can they spare?
4. What will management keep as evidence?
5. What will each approach cost over three years, including staff time?
A worked example
This example is an illustration, not a real company. A company has 40 finance users and one main finance system. Access changes about four times a year, and the auditors will ask for support in January. The Controller answers the five questions. Access changes are rare. The need is one answer at a point in time. Two people can spare a few hours, but not a monthly alert routine. A point in time diagnostic looks like a fair fit. If the company grows and access starts changing weekly, the Controller can look at ongoing monitoring again. The Controller writes the reasons down either way.
Frequently asked questions
Can we use both?
Yes. A company might run monitoring and also order a point in time review for a special purpose. Check that the two do not repeat the same work before you pay for both.
Does a potential conflict mean someone did something wrong?
No. It means the access combination deserves a closer look. A safeguard may change the answer.
Is ongoing monitoring always more complete?
Not by itself. It depends on the rules, the data and the people who review alerts.
Is a periodic diagnostic a full audit?
No. It examines potential conflicts. It is not a full SOX audit or a full user access review.
Which one costs less?
It depends on staff time, setup and how often you repeat the work. Compare the full cost, not only the price.
Your next step
This week, write one business question, such as “Could the same person set up a vendor and approve the payment?” Then ask IT how often that access changes. Use the free How to Compare Segregation of Duties Review Options to compare how often, who owns it, what evidence you keep, and what it costs. You do not need to give an email address to get it.
Want to compare named software? Read Fastpath, Strongpoint or SOD Check: What Is Different? Weighing other options? Read What Can You Do Instead of Buying SOD Software? The overview is at /products/compare.
Top internal controls and SOX education for growing companies.