Resources
What Reports Do I Need for a Segregation of Duties Review?
A segregation of duties review is also called an analysis or an assessment. This page uses the terms interchangeably.
You need four things: a list of users and whether each account is active, the roles each user holds, the rights each role gives, and the date and system each file came from. Running these reports usually takes system administrator rights. So the Controller asks the system administrator, and the system owner approves the request. This is the Capture Data step.
Why does the first step matter? Start with a picture.
Picture a Controller who asks IT for “the user list.” Two weeks later a spreadsheet arrives. It has names and job titles. It has no roles, no rights and no date. Nobody can tell if it shows access from last week or last year. It cannot answer the real question: who can add a vendor and also approve a payment? The review stalls before it starts, and the Controller has lost two weeks.
Now picture a finance specialist whose role is called “Finance Approver.” The name sounds safe. But a role name is only a label. It does not say whether the same role can also create vendors. You only learn that from a second file that lists what the role can do.
Think of a building with key cards. The user list says who holds a card. The role list says what kind of card each person holds. The rights list says which doors each kind of card opens. The date says when the list was printed. You need all four to know who can walk into the vendor room and the payment room. A list of names alone is a list of people, not a list of doors.
Which reports should I ask for?
Use this as a request plan. Report names differ from system to system, and one report may hold more than one item. Ask for the content, not a fixed report name.
| What to ask for | What it tells you | Check before you accept it |
|---|---|---|
| 1. User list with status | Who has an account, and whether it is active | Includes the user types you agreed on. Inactive accounts are marked, not removed. |
| 2. User-to-role list | Which roles each person holds | User IDs match the user list. |
| 3. Role-to-rights list | What each role lets a person do | Covers the rights tied to your payment, vendor or payroll steps. Includes limits, such as an approval amount. |
| 4. Custom roles and direct rights | Access given outside the standard roles | Custom roles and one-off grants are listed, or the file says there are none. |
| 5. System and date note | Which system, which environment, which day | Every file shows the system name and the date it was run. |
Who can run these reports?
A system administrator is a person with elevated rights in a system, including the right to run reports. Running the reports for a segregation of duties review usually takes that level of access. A system owner is a person with the authority to approve changes to the system. Sometimes one person is both, but not always.
| Person | Their part |
|---|---|
| Controller or process owner | Names the processes and systems in scope. Picks the review date. Reviews the results. |
| System administrator | Runs the reports. Records the system and the date on each file. |
| System owner | Approves the request, and any later change to the system. |
| IT leader | Helps find the right system administrator. Arranges secure sharing. |
The Controller does not need to run reports or read raw permission codes. The Controller does need to say what the review should cover. Companies route these requests in different ways, such as an IT ticket or a change request. Follow your company’s own route. What matters is that the system owner approves the request and the system administrator runs it.
What if nobody on my team has administrator rights?
This happens often. The system may be run by a vendor, or by a shared team in another office. Ask the system owner to approve the request and to name who will run it. Do not borrow someone else’s login. Do not ask a specialist to run reports under another person’s name. Write down who ran each file and when.
How do I know the files are complete?
Start by comparing the files with the scope you agreed. Do the role files use the same user IDs as the user list? Are any role names or fields blank? Decide how to treat service accounts and contractors, and write it down. Then pick three or four accounts and ask the administrator to show you their roles on screen. Compare that with the file. This is a reasonableness check. It does not prove the file is complete. Note any gaps instead of quietly dropping records.
How should we share the files?
Access files show who can do what in your systems. Send them only by the company’s approved secure method, and only to people who need them. Never send them through a public web form. Keep the date and the file version with each file.
What does this step not do?
Capturing data collects facts. It does not find conflicts, and it does not prove that anything is wrong. The next step, Highlight Conflicts, looks across the files for combinations that deserve a closer look. This guide explains a review process. It is not an audit.
A worked example
This example is an illustration, not a real event. A user list shows one person with the role “Finance Approver.” The Controller asks the system administrator for the role-to-rights list. It shows that this role can also create vendors, and that the approval limit is high. Without the third file, the team would have guessed from the role name. With it, the team has facts and can move on to the next step.
Frequently asked questions
Can I use a screenshot instead of a report?
A screenshot can explain a setting. It rarely shows every user, so use it as a spot check, not as the file.
Do I need every system?
No. Start with the system that handles payments or payroll. Write down which systems are left out so the result is not overstated.
What if the report I need does not exist?
Tell the system owner. Agree on another supported way to get the same facts. Do not guess at a report name.
Who is the system owner?
See the table above. If your company has not named one, settle that before the review.
Do I have to understand the permission codes?
No. Ask the system administrator to explain each right in plain words next to the code.
Your next step
Send the five-item request to your system administrator this week, and ask your system owner to approve it. The free How to Capture Data for a Segregation of Duties Review: Capture Data Worksheet gives you one page to list each file, who ran it, the date, and any gap. You do not need to give an email address to get it.
New to the method? Start with how to run a segregation of duties review. Ready for the next step? See how conflicts are highlighted.
Top internal controls and SOX education for growing companies.