Resources
How Do I Run a Segregation of Duties Review?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
Run a segregation of duties review in five steps. Capture Data on who has access. Highlight Conflicts where one person can do two jobs that should be separate. Examine Results to see what the access really allows. Confirm Safeguards that cover the risk. Keep a Record of Decisions so anyone can see what was decided and why.
Why should a Controller care? Start with two small stories.
Story one: the vendor payment. Picture an accounts payable specialist who can add a new vendor and also approve payments to that vendor. One day the specialist mistypes a bank account number when adding a vendor. The specialist then approves the payment. Nobody else ever looks at it. The money goes to the wrong account, and no second person had a chance to catch the mistake. Now picture the same access in the hands of someone who does it on purpose. They add a vendor that is really their own account and pay it. Either way, the problem is the same. One person controlled the whole path from setup to payment, so nothing stood in the way.
Story two: the paycheck. Now picture someone in HR or payroll who can change an employee’s salary in the payroll system and also run the payroll that pays it. If they enter the wrong pay rate, the wrong amount goes out, and nobody reviews it before it does. If they change a pay rate on purpose, the same thing happens. Again, one person starts the change and finishes it.
The pattern. In both stories, the person did not need bad intentions. A tired afternoon is enough. The risk comes from the combination of access, not from the person. Think of a restaurant where the same person cooks the food, takes the money, and counts the cash drawer at night. Even a great employee should not carry all three jobs, for their own protection as much as the owner’s.
What is segregation of duties in plain words?
Segregation of duties means no single person can start and finish a risky task alone. A second person, or a second step, sits in the middle. It works like a bank vault that needs two keys. Neither key holder can open it alone. The goal is not to distrust people. The goal is to catch honest mistakes early and make wrong-doing harder.
What about access that is simply too wide?
A related problem is access that is broader than the job. Imagine you hire a landscaper to work on your backyard. You would not hand over the master key to your whole house. You would open the back gate. In many systems, people get the master key because it is easier to set up, or because their role grew over time. Then the “landscaper” can walk into rooms they never needed. A segregation of duties review looks for these cases, especially where the extra access also creates a conflict like the ones above.
What are the five steps?
| Step | The question it answers | What you end up with |
|---|---|---|
| 1. Capture Data | Who has access to what, in which systems, as of which date? | Dated lists of users, roles, and permissions |
| 2. Highlight Conflicts | Where can one person do two jobs that should be separate? | A list of potential conflicts, sorted by process |
| 3. Examine Results | What can each person with a potential conflict really do? | Facts, evidence, and open questions for each item |
| 4. Confirm Safeguards | Does another control cover the risk, and does it really run? | Evidence that a safeguard works, or a note that it does not |
| 5. Keep a Record of Decisions | What did management decide, and why? | A log with an owner and a due date for every open item |
For a free overview, download the SOD Check Method Overview: the five steps in six pictures.
Each step has its own guide: Capture Data, Highlight Conflicts, Examine Results, Confirm Safeguards, and Keep a Record of Decisions.
Who does what?
| Person | Their part |
|---|---|
| Controller or process owner | Explains the financial process. Decides what the risk means for the company. |
| IT and/or system administrator | Runs the access reports, which usually takes system administrator rights. Confirms what the access really allows. Makes approved access changes once the system owner approves them. |
| Internal audit or SOX lead | May advise on what evidence is expected. |
The Controller does not need to read raw permission codes. IT does not need to decide the company’s financial risk. Each person covers the part they know best. A system administrator has elevated rights in a system, including the right to run reports. A system owner has the authority to approve changes to the system. Sometimes one person is both, but not always.
What does a potential conflict mean? And what does it not mean?
A potential conflict means “look here.” It does not prove fraud. It does not prove a failed control. Many potential conflicts end with a simple answer, such as “this person’s approval limit is zero” or “a manager reviews every payment.” Others end with a fix. Either result is a good outcome, because now someone has checked.
What does a review look like in practice?
A review potential conflicts a user who can add vendors and approve payments. IT confirms that both rights are active. The accounts payable owner explains how payments are approved. The Controller asks for proof that a second person reviews payments. If the proof is missing, the team writes down the gap, names an owner, and sets a due date. The review has turned a worry into a decision.
How do I keep the review from stalling?
- Before you start, take the free 10-question readiness check: 10 Questions Before Your Next Segregation of Duties Review.
- Start with one system and one date.
- Name a system administrator and a system owner in IT, and a business owner in finance.
- Set a standing time for open questions.
- Give every open item a person and a due date.
Frequently asked questions
Does a potential conflict mean someone did something wrong?
No. It means the access combination deserves a look.
Can I remove every conflict?
Not always. A small team may not have enough people to split every job. In that case, a safeguard and a written decision matter even more.
Is this the same as a user access review?
No. A user access review asks whether each person’s access is appropriate overall. A segregation of duties review looks for combinations of access that should not sit with one person.
Is this a full audit?
No. This guide explains a review process. It is not an audit and does not prove that controls are effective.
How many systems should I start with?
One. Pick the system that handles payments or payroll, finish a full pass, and then add more.
Your next step
Download the free What Approach Can I Use to Prepare or Perform Segregation of Duties Analysis. It is a short guide with one page for each of the five steps, and it shows who owns each one and where to write your next action. You do not need to give an email address to get it.
Want to compare ways to approach this work? See how the options compare.
Top internal controls and SOX education for growing companies.