Segregation of Duties (SoD) is the control that stops any single person from owning a sensitive process from start to finish. The person who requests a payment should not be the one who approves it, and neither should be the one who runs it. When one person holds two of those duties, you have an SoD conflict — and it is usually the first thing an auditor looks for, because it is where both fraud and honest error start.
This guide walks through eight of the most common conflicts, why each one matters, and how to check your own organisation for them.
What counts as an SoD conflict
A conflict is not about a single powerful permission. It is about a combination. On its own, “create a vendor” is a normal job. “Run a payment” is a normal job. The risk appears when the same person can do both: now they can set up a supplier that only they know about and pay it, with no second pair of hands in the loop.
So an SoD review is really a search for people who hold two duties that were meant to stay apart.
8 classic Segregation of Duties conflicts
These are drawn from the procure-to-pay, payments, and general-ledger cycles, where most real-world SoD findings sit.
| The two duties held together | Why it's a risk | Level |
|---|---|---|
| Create / maintain vendor + Run payment | Set up a fictitious supplier and pay it, start to finish. | High |
| Post vendor invoice + Approve payment | Enter spend and approve it yourself — no independent check. | High |
| Approve payment + Run payment | Control the entire release cycle with no second sign-off. | High |
| Maintain bank details + Run payment | Redirect a supplier's bank account, then pay into it. | High |
| Maintain vendor + Post invoice | Create a payee and raise the bill that pays them. | High |
| Create purchase order + Goods receipt | Order goods and confirm a delivery that never arrived. | Medium |
| Post journal entry + Approve journal entry | Post an adjustment and approve your own posting. | Medium |
| Create customer + Post credit note | Issue credits to an account you control. | Medium |
Your own list will be longer and shaped by your systems, but if you only check these eight you have already covered the conflicts that show up most often in audit findings.
Check your own organisation — free
Build your team, tick the permissions each person holds, and see conflicts flagged instantly. No install, up to five people free.
Open the free toolHow to check for SoD conflicts
Whatever the size of the organisation, the method is the same three steps:
- Map access. List each person and the permissions (roles, transaction codes) they hold across your systems.
- Define the rules. Decide which permission pairs conflict — the eight above are a solid starting library.
- Flag the overlaps. Find anyone who holds both sides of a rule. Those are your conflicts to review or mitigate.
A small team can do this in a spreadsheet. Beyond a handful of people it gets error-prone fast, which is why most teams apply a rule library across everyone at once and let the overlaps surface automatically.
What to do with a conflict
A flagged conflict is not automatically a problem — it is a question to answer. You can remove one of the two permissions, split the duty to another person, or accept and mitigate it with a compensating control (for example, an independent review of every payment that person runs). What matters is that the decision is documented, so that when the auditor asks, you have an answer rather than a surprise.
Frequently asked questions
What is segregation of duties?
A control that splits a sensitive process across two or more people so no single person can complete it alone. It limits both fraud and honest error by keeping the requester, the approver, and the executor separate.
Is it “segregation” or “separation” of duties?
The same thing. “Segregation” is more common in audit and SOX; “separation” is common in security and IT. Both describe splitting a process so no one controls it end to end.
How many conflicts should a company track?
Start small and real. A focused library of the ten or so conflicts that matter most for your cycles beats a giant list nobody maintains. Grow it as your processes and systems grow.