What is Segregation of Duties?

What is Segregation of Duties?

Segregation of duties (SoD) is the control principle that no single person should hold enough authority or system access to both carry out and conceal an error or fraud.

It is achieved by dividing the authorization, recording, custody and reconciliation of a transaction among different people or roles. NIST defines separation of duty as the principle that no user should be given enough privileges to misuse the system on their own, giving the example that the person authorizing a paycheck should not also be the one who can prepare it (NIST CSRC glossary, from SP 800-192). In the COSO Internal Control - Integrated Framework it belongs to Principle 10 on control activities: segregation of duties is typically built into the selection and development of control activities, and where it is not practical, management selects alternative control activities. NIST SP 800-53 carries it as control AC-5, Separation of Duties.

Why it matters

• It is the primary defense against internal fraud. Most misappropriation schemes depend on one person controlling more than one step.
• Auditors test it directly. SoD conflicts in ERP access are among the most common SOX and ITGC findings.
• It scales badly without design. Every new system, role or reorganization can create a conflict that nobody assigned.

The four functions to separate

• Authorization: approving a transaction, such as a purchase order or a credit limit.
• Recording: entering it in the books or the system of record.
• Custody: holding the asset, such as cash, inventory or the payment file.
• Reconciliation and review: checking that records agree with the assets and with independent sources.

A person who holds two of these for the same transaction stream has a conflict. Classic examples are creating a vendor and approving its invoices, or posting journal entries and performing the bank reconciliation.

Segregation of duties in systems

In practice most SoD is enforced through access design: role-based access control, a conflict matrix listing incompatible permissions, and periodic access reviews that flag users who hold conflicting roles. Static SoD blocks the combination at assignment; dynamic SoD allows both permissions but prevents one user from performing both steps on the same record, as in two-person approval rules.

When separation is not practical

Small teams cannot always split every function. COSO expects management to select alternative, compensating controls in that case: independent review of transactions by a manager, detailed reconciliations performed by someone outside the process, exception reports, or mandatory vacations and job rotation. The compensating control must be precise enough to catch the error the missing segregation would have prevented.

Related terms

• Internal controls
• Access control
• Role-based access control (RBAC)
• SOX control testing
• Risk control matrix (RCM)
• Internal control management

In SmartSuite

SmartSuite SOX Management holds the SoD rules alongside the control library, links access review evidence to the ITGC and business controls that depend on it, and routes any conflict found in a review into the issue log with an owner and a compensating-control note.

Frequently asked questions

What is the difference between segregation of duties and least privilege?

Least privilege limits each user to the minimum access needed for their job. Segregation of duties goes further by ensuring that two specific functions, such as approving and paying, are never combined in one person even if each is legitimately needed. Least privilege reduces exposure; SoD removes the conflict.

How do auditors test segregation of duties?

They obtain the list of users and roles from each in-scope system, run it against a conflict ruleset, and inspect the exceptions. For each conflict they check whether a documented compensating control exists and test that control. They also review the access provisioning and periodic access review controls that keep conflicts from reappearing.

Can a small company achieve segregation of duties?

Rarely in full. The practical answer is to separate the highest-risk pairs first, especially anything that combines custody of cash with recording or approval, and to cover the rest with owner or manager review, independent reconciliations and system reports that make every transaction visible to someone other than the person who entered it.