Core Concepts lessons

Core Concepts · Lesson 2

Segregation of Duties

Toxic combinations, compensating controls, and how SoD engines flag fraud paths.

Segregation of Duties (SoD) prevents one person from completing conflicting steps in a sensitive process — typically create + approve, change master data + disburse funds, or deploy + approve the same change.

SoD is not only finance. Identity administration (create account + assign privileged role), HR/payroll (bank detail change + payroll run), and engineering (deploy + change approval) all have toxic pairs.

Controls come in layers:

  • Preventive — policy blocks the combination at request or provisioning time.
  • Detective — continuous scans find toxic pairs that already exist.
  • Compensating — dual control, monitoring, or time-bound exceptions when business reality requires overlap.

Document every exception with an owner, expiry, and residual risk. Auditors care less about “zero conflicts forever” and more about known, governed exceptions.

Reinforce pattern recognition with Spot the SoD Conflict below.

Segregation of Duties: toxic combinations

When two permissions become a fraud risk

Classic SoD conflicts that create fraud and error risk — and the controls that catch them. Create Vendor combined with Approve Payment creates SoD conflict: One person can invent a vendor and pay them — classic fraud path. Control: block the combination, require dual control, or alert in real time.

Create Vendor

AP clerk entitlement

Safe alone

Click to reveal

Approve Payment

Finance approver entitlement

Safe alone

  • Safe alone — Each entitlement is fine in isolation
  • Toxic together — Combined in one identity = SoD violation

Learn more: Open related lesson →

Interactive game

Spot the SoD Conflict

Find the toxic entitlement combination in each round.

Score 0/5·Round 1/5

Which pair creates a Segregation of Duties conflict?

Mark complete

Save progress on this device. Track completion unlocks badges in a later release.