Segregation of Duties (SoD) is an internal control principle that splits critical tasks across multiple people. It prevents any single individual from controlling an entire financial process end-to-end.
What is Segregation of Duties?
Segregation of Duties (or SoD) is a foundational principle of internal control. It ensures no single employee can both execute and approve a sensitive transaction.
SoD typically separates four categories of duties:
• Authorization — approving a transaction (e.g. a purchase order).
• Custody — holding the asset (e.g. cash, inventory, system access).
• Recording — booking the transaction in the ledger.
• Reconciliation — verifying that records match reality.
How it works
SoD is enforced through an SoD matrix that maps incompatible role combinations.
Each conflict is rated by risk level: $Risk = Likelihood \times Impact$
Three control modes are possible:
• Preventive SoD: The system blocks the user from holding incompatible roles.
• Detective SoD: Periodic review surfaces conflicts after the fact.
• Compensating control: When full SoD is impossible (small teams), a secondary review is added.
Why it matters for finance & audit teams
A rigorous Segregation of Duties policy is a cornerstone of audit and fraud prevention.
• Fraud prevention: A single person cannot create a fake vendor and pay it.
• SOX & Sapin II compliance: SoD is an explicit requirement of most regulatory frameworks.
• Audit readiness: A documented SoD matrix accelerates external audits.
• Operational integrity: Errors are caught earlier in the process chain.
Segregation of Duties vs Least Privilege
SoD is often confused with the principle of least privilege.
• Least privilege restricts what a user can access (minimum rights).
• SoD restricts which combinations of duties a single user can hold.
• Least privilege is a prerequisite; SoD is the cross-functional logic on top of it.
Mastering Segregation of Duties is the foundation of a sound control environment. With modern continuous controls monitoring platforms, finance teams now detect SoD conflicts in real time across 100% of transactions.