Workday Segregation of Duties Analysis

Your Workday roles may look fine one by one. What happens when one person can change pay and also approve it?

One person might change pay through one security group and approve the same change through another. Neither group tells the full story alone. SOD Check shows where one person’s access could give them too much control over one HR or payroll process. Our software does the analysis. Experienced practitioners review the results before they are delivered to you.

SOD Check has been used by public and pre-IPO companies for 15+ years · No software to buy or implement · No direct access to your Workday · A service of A2Q2

A2Q2 has helped 30+ public companies strengthen controls, 17 before their IPO.

Watch the Workday demos and walkthroughs

See the videos below for what you receive.

Essential: get a snapshot

Pro: compare your results, see what changed

Premium: completeness, accuracy, evidence

What is a Workday segregation of duties analysis?

A Workday segregation of duties analysis checks whether one person can do two jobs that need a second set of eyes. An example is changing an employee’s pay and also processing the payroll that pays it. SOD Check finds these combinations, ranks them High or Medium, and suggests fixes for management to weigh.

People also call this a Workday segregation of duties analysis or assessment. A review looks at who has what access. An analysis finds access that may conflict. An assessment is your management team deciding what that means. SOD Check is a technology-enabled segregation of duties diagnostic service from A2Q2 for finance and HR systems like NetSuite and Workday. Software analyzes your access data and experienced practitioners review the results. Your management team does the assessment.

A potential conflict does not prove that a pay change was wrong. It does not prove that a safeguard failed. It shows where to look.

What does the Controller need to decide?

Decide whether the people who change employee pay data are kept apart from the people who run payroll. In most companies, HR changes employee data and payroll, often under finance or accounting, runs the pay. The risk to weigh is overpayment.

Here is how it happens. A pay change is entered with the wrong amount. Payroll runs. The employee is overpaid. An underpaid employee speaks up. An overpayment can go unnoticed. The company loses money, and getting it back can be hard, because of state law or goodwill.

In a small company, one person may both change pay and run payroll. That is common. In that case, a separate person, such as the Controller or someone in accounting, should review that work each month. They compare the month’s pay changes to the written offer letters, promotion letters or written approvals. They record what they checked and what they found. This review happens after the fact. It does not stop a wrong entry.

Your auditor may ask:

• Who can change pay in Workday today?
• Who processes payroll?
• Can the same person do both?
• How did management review the results, and what did it decide?

Workday access also drifts. People transfer, take on new duties, cover for a teammate, or leave. Access that made sense last year may not fit today.

How do Workday security groups work?

A security group is a set of users who share the same access. Workday builds some groups. Your company assigns others to named people. Some come from a person’s job, such as manager. Two kinds of rules decide what a group can do:

• Domain security policies control who can view or change data, such as pay.
• Business process security policies control who can start or approve a step, such as a pay change.

Your company sets which groups hold which access. A person can belong to more than one group. That is why one group may look fine alone.

Which HR and payroll processes does it cover?

SOD Check looks at the HR and payroll steps where one person could hold too much control. Common ones are new hires, pay and status changes, terminations, payroll processing, time and attendance, and system administration. Your results show which people and which access add up to each potential conflict.

These are examples. Your company’s processes set what matters most.

What will you receive?

You receive Excel workbooks. The Chain-of-Evidence Workbook shows the key results on one page and links each number to the Workday data behind it. The Detailed Diagnostic Workbook lists every potential conflict, ranked High or Medium, with recommended fixes. Some packages add comparisons, executive slides, and audit support.

• A current picture, fast. Results are guaranteed within 10 business days after we receive the required documents.
• Every number traced to its source. Your team can check the results and walk your auditor through them.
• Support for your auditor’s questions. Premium adds checks by our team on the Workday data behind the analysis, including its completeness and accuracy.
• A clear path for management. You get recommended fixes and the SOD Check Method to write down what management decided.

Have a deadline? Tell us when your auditor needs the results. We will tell you what it takes to meet it.

See example reports

Three sample views from a Workday analysis. Click any view to enlarge it. The names and data are samples.

1. Executive summary trend.

One page shows eight key counts across diagnostic periods, so you can see what changed.

2. Chain of evidence.

Every number on the summary is traced to the data you provided.

3. Comparison to the previous period.

Counts of conflicts now against the last diagnostic: what is new and what went away.

What does our Workday system administrator need to do?

Your Workday system administrator runs one report, Security Group Assignments – All Account Types, with four fields. They export it to Excel and add a screenshot that shows when and where it was run. We send step-by-step instructions. We never log in to Workday.

1. Run the Security Group Assignments – All Account Types report, with no filters.
2. Export it to Excel and add a screenshot of it.
3. Upload the file to the secure shared folder.

Your administrator does not need to know which fields a review needs. The instructions list them, and show how to build the report if your company has not created it before.

Your team stays in control. In a free 15-minute call, we confirm your Workday setup, the data needed, your timing, and next steps for a fixed quote.

What does SOD Check look at in Workday?

Your report lists the security groups each account belongs to. SOD Check then maps each group to what it allows. A potential conflict can come from two places:

• Inside one group. One group allows two things that need a check.
• Across groups. Each group looks fine alone. Together they give too much control.

Why it matters: a process may have no check, pay may be wrong or paid to the wrong place, or activity that affects the financial statements may go unchecked.

For each potential conflict, your results show: who is affected; which groups and permissions add up to it; what the access could allow; and whether it is High or Medium.

How does the SOD Check Method apply to Workday?

Finding a potential conflict is where the review starts. It is not where it ends. SOD Check uses the SOD Check Method in five steps:

1. Capture Data. Your system administrator sends the Workday report.
2. Highlight Conflicts. We highlight where one person’s access could cover too much of one process.
3. Examine Results. Experienced practitioners review each item and rank it High or Medium.
4. Confirm Safeguards. Management checks which other controls may already cover the risk.
5. Keep a Record of Decisions. Management writes down what it kept, removed, or added, and why.

You also get recommended fixes. Management decides what to change.

What if we use Workday approval workflows?

An approval workflow may be an important safeguard. It may control only the routing it covers. Direct edits may still be possible, depending on how access is set up. SOD Check highlights the combination as a potential conflict at the permission level. Management then checks whether the workflow covers the risk.

In Workday, the step that approves a pay change and the right to edit pay data may be set in different places. A pay change may route to a director for approval. Another security group may still be able to edit the same pay data. Depending on how your Workday is set up, other routes may include integrations or administrative access. The workflow covers one route. It may not cover the others. Management checks each route, then records the decision.

Management can keep the access because a control covers it, remove access that is not needed, change a workflow, or add a control. The Controller and process owners weigh the risk. Authorized system staff make the approved changes. A potential conflict is a starting point. It is not an automatic instruction to remove access.

What if responsibilities go beyond Workday?

Workday is often not the only system in the process. Pay data moves to payroll and to your general ledger. SOD Check can review conflicts that cross systems, work done outside systems, or both. We set the systems and processes with you before work starts.

For example, someone could change employee pay in Workday. The same person could post payroll journal entries in NetSuite. If payroll runs in ADP, that is part of the same process. No one system shows the whole picture alone.

A Workday-only diagnostic does not cover other systems by default. A cross-system analysis needs a completed SOD Check diagnostic for each system first, and it is scoped separately.

When should we run a Workday analysis?

Common reasons are an auditor request, a new Workday setup or module, a move to a new payroll provider, role or security changes, a reorganization, a known concern, or a regular check. Having a reason to check does not mean there is a problem.

Want to do the Workday segregation of duties analysis yourself?

Here are free workbooks you can fill in for yourself.

• Workday Essential, Chain-of-Evidence Workbook
• Workday Pro, Chain-of-Evidence Workbook
• Workday Premium, Chain-of-Evidence Workbook
• Workday Essential, Detailed Diagnostic Workbook
• Workday Pro, Detailed Diagnostic Workbook
• Workday Premium, Detailed Diagnostic Workbook

Which package should we choose?

Each package is a fixed price per system, per run. Choose by the question your team needs answered. We share pricing once we understand your scope.

We are so confident in the results you receive that you get three guarantees

See what each package includes on the Products page.

Need it sooner? Expedited 5-business-day delivery is available for an additional fee, subject to capacity. See how the packages compare.

Who can do a Workday segregation of duties analysis: our own team, software or a service?

Four kinds of provider can do a Workday segregation of duties analysis: your own team, a consultant, software your company licenses and runs, or a diagnostic service such as SOD Check. With SOD Check, your system administrator sends one Workday report. Our software analyzes it. Experienced practitioners review the results. Your management team assesses them and decides what to change.

You can run a Workday analysis on your own. You would build and maintain the data needs, the segregation of duties rules, the analysis across groups, the ranking, and the evidence. SOD Check gives you a result reviewed by practitioners when you need it. There is nothing to install. Software can fit a company that wants to run continuous monitoring itself. Compare scope, how often you need results, who does the work, and cost. See the full comparison.

Who is behind SOD Check?

Top internal controls and SOX education for growing companies. SOD Check is a service of A2Q2, a SOX and internal controls firm. A2Q2 has helped 30+ public companies strengthen controls, 17 before their IPO.

Kim Le, top internal controls and SOX educator | Former public company audit committee chair | Helped 40+ public companies strengthen controls, 19 before their IPO.

Kim Le designed SOD Check. She is a CPA and CIA with more than 30 years of public accounting experience serving public and private companies.

SOD Check has been field-tested and used for more than 15 years. It has run as a methodical, systematic diagnostic since 2011. Experienced practitioners review every diagnostic.

Workday questions

Do you need access to our Workday?

No. Your system administrator runs one report and uploads it to a secure shared folder. We never log in to Workday.

What Workday information do we provide?

One report, Security Group Assignments – All Account Types, exported to Excel with a screenshot. We send the exact steps after we confirm your setup.

Does it cover payroll?

It covers the Workday access and the HR and payroll steps in the agreed scope. If payroll is processed in another system, a Workday-only diagnostic does not cover that system. A separately scoped cross-system analysis may fit after each system has its own diagnostic.

What if a workflow prevents self-approval?

It may help, but it may cover only one route. Management should treat it as a possible safeguard, then check whether other routes still allow the change.

Does every High rating mean we must remove access?

No. Management looks at the context and the safeguards, then decides.

Can this help us answer our auditor?

Yes. It gives you analysis and supporting evidence. Your external auditor decides if the evidence is enough.

Does SOD Check make the fixes?

No. No automatic fixes are included. Any broader help needs a scope we agree on in writing.

Is this the same as a user access review?

No. Segregation of duties looks at conflicting responsibilities or access. A user access review asks whether access is right for the job more broadly.

Can we run it again after access changes?

Yes. A later run shows what changed. The result may be better, the same, or worse.

Know what your Workday access allows, before the next audit discussion

Each of your Workday security groups may look fine on its own. SOD Check shows what they allow together, and where a potential conflict deserves a look. Start with the free checklist to prepare for your audit. If your auditor is waiting, tell us your deadline.

Know what people can do. Understand what could go wrong. Focus on what matters. No software to install. No direct access to Workday. Your team stays in control.

SOD Check is a service of A2Q2.