Make sure no one can do it all alone.

The problem it solves

Picture one person in accounts payable who can add a new supplier, approve that supplier’s invoice, and release the payment. Nothing stops them creating a fake vendor and paying it — there is no second pair of eyes anywhere in the chain. That combination of rights is toxic: each permission is fine alone, but together in one person they remove the check the process depends on.

Every fraud that one person could commit alone is a segregation-of-duties failure waiting to be found.

How the control works

SoD breaks a sensitive process into roles — who requests, who authorises, who records, and who has custody of the asset — and keeps conflicting roles in different hands. The four classics are: initiation vs approval, custody vs recording, and either of those vs reconciliation. When one person holds two sides of the same transaction, you have a conflict to fix — by reassigning access, adding an approval step, or accepting the risk with a documented compensating control.

Why it is hard in practice

On paper the rules are simple. In real systems, access drifts: people change roles and keep old permissions, cover for colleagues on leave, or accumulate rights no one ever reviews. The conflicts hide in the combinations, which is exactly what’s tedious to spot by eye across a whole team. This is where a tool earns its place — it reads everyone’s access at once and checks it against a library of known toxic pairs.

What the free tool does

Our free Segregation of Duties analyzer walks it in three steps: build a small organisation, assign each person their access from a set of common permissions, then let the engine flag every conflict — who can do too much, and which rule they break. It’s the fastest way to see SoD on your own structure rather than in the abstract.