Segregation of duties (SoD), also called separation of duties, is an internal control that divides important responsibilities among different people or organizational groups. It is designed to stop one person from controlling every key stage of a transaction or change, reducing the chance that an error, misuse, or fraud can be carried out and concealed without detection.
What segregation of duties means
SoD is a control-design principle: separate responsibilities that would create too much risk if one person could perform them all. The U.S. Government Accountability Office (GAO) identifies transaction authorization, processing and recording, review, and handling related assets as duties that may need to be divided. No single person should control every key aspect of a transaction or event when that concentration could enable error or fraud.
As an Amazon Associate I earn from qualifying purchases.
In information technology, the same principle applies to computer-related operations. Policies, procedures, organizational structures, and access controls should prevent one individual from independently controlling all important aspects of an operation or gaining undetected access to assets or records. Separation does not make every action automatically authorized; weak separation can leave organizations exposed to improper transactions, program changes, or damage to computer resources. GAO’s federal internal-control standard and its Federal Information System Controls Audit Manual describe these control principles.
Examples of duties to separate
Payroll
A person should not independently authorize, process, and review payroll transactions. If one person controls all three stages, that person could increase selected payments without another person noticing, as the GAO audit manual illustrates.
#1 Best Overall
Software changes
One programmer should not independently write, test, and approve a program change. Depending on the system’s risk, organizations can separate user authorization, development, testing, review, and release so that a change is not created and put into operation without independent checks.
Accounts payable
Oracle’s Oracle Fusion Applications Common Implementation Guide for 11g Release 1 gives examples of potentially incompatible duties, including creating payables invoices and creating payables payments, or updating a supplier’s bank account and approving an invoice. These are configurable application-policy examples, not universal rules for every organization.
Cash receipts and accounting records
If the person who handles cash receipts can also make the related accounting entries, that person could alter records to conceal a shortage. An independent review of entries can help detect that kind of conflict.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow organizations apply SoD
- Map the process. List the activities that could let someone initiate, authorize, execute, record, conceal, or review the same transaction or change.
- Identify incompatible responsibilities. Assess the assets, business process, system permissions, and risks involved. A conflict depends on what the person can actually do, not just their job title.
- Assign and document duties. Where practical, distribute incompatible responsibilities among different people or organizational units. Document the assignments and communicate them to staff.
- Enforce the separation. Use physical and logical access controls so the assigned boundaries are reflected in the workplace and systems. Supervision and review are also necessary for risks that permissions alone cannot address.
- Review access and approvals. Reassess access as roles and processes change, and check that approvals and reviews remain appropriate. GAO’s audit guidance describes owner approval for access that creates a conflict, security-administrator review, periodic owner review, and monitoring.
In applications, SoD policies can define conflicting privileges or combinations of roles. Rules may also depend on context, such as whether access applies within the same business unit. Their scope should reflect the organization’s processes and risk tolerance rather than being copied mechanically from a generic role matrix or vendor rule library.
Rank #3
What to do when full separation is impractical
Small teams may not have enough staff to assign every step to a different person. Management can accept a specific conflict when justified by resource constraints and risk, but should add a compensating control that addresses the exposure and produces evidence that it operated. Possible controls include:
- Requiring an additional approval before a transaction is entered.
- Having an independent person review posted transactions or reports.
- Increasing supervision or monitoring of the activity.
- Adding another approval level for the conflicting access or action.
The control should be tailored to the conflict, assigned to someone suitably independent, and documented so the organization can show that the review took place. GAO’s audit manual discusses compensating controls for conflicts that cannot be removed.
Rank #4
How to assess an SoD control or tool
Whether the control is manual or automated, assess it against the process and risks it is meant to cover:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Prevention or detection: Does it block conflicting access before assignment, or flag conflicts for review after access or activity occurs?
- Coverage and rule quality: Does it account for the relevant roles, privileges, processes, and data context? Are its rules based on how the organization actually operates?
- Review evidence: Can the organization show who approved access, reviewed a conflict, and monitored any compensating control?
- Ongoing ownership: Who maintains the rules and performs periodic reviews? Oracle cautions that greater segregation can increase implementation and maintenance complexity.
Automated conflict checks depend on the business rules configured for them. They can help identify conflicts, but they do not replace sound process design, risk decisions, or follow-up on exceptions.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
