What happens when Segregation of Duties is managed with manual spreadsheets instead of a dedicated control platform?

Manual approaches usually become inaccurate as access changes, role sprawl increases, and auditors demand evidence. They struggle to analyze every access route, so violations slip through and remediation lags behind business change. The result is more exposure to unauthorized access, weaker compliance reporting, and a higher chance that conflicting privileges remain in place long enough to matter.

Why Manual SoD Tracking Fails Security Teams

segregation of duties only works when the control picture stays current across roles, entitlements, exceptions, and compensating controls. Manual spreadsheets rarely keep pace with access change, so the record of who can approve, create, and pay is already stale by the time it is reviewed. That creates a gap between policy and reality, which is exactly where audit findings and abuse paths accumulate. NHIMG notes that 97% of NHIs carry excessive privileges, a reminder that entitlement sprawl is not theoretical but the normal state in many environments, and it becomes even harder to govern when tracking is manual. See the Top 10 NHI Issues and the Ultimate Guide to NHIs — Regulatory and Audit Perspectives for the governance angle.

Manual SoD tracking also obscures the full path of privilege. A spreadsheet can list a named role, but it often misses inherited access, shared service accounts, temporary elevation, and indirect paths through tickets or integrations. In practice, that means a conflicting duty can exist for weeks without triggering review, especially when business changes are frequent and approvals are handled outside the spreadsheet process. Practitioners usually discover the issue during audit evidence collection, not when the conflict is introduced.

How Control Platforms Enforce SoD More Reliably

A dedicated control platform changes SoD from periodic bookkeeping into continuous control monitoring. Instead of relying on a static worksheet, the platform ingests identity and entitlement data, maps it to SoD rules, and evaluates conflicts whenever access changes. The practical difference is that the control is tested against current state, not last month’s snapshot. NIST Cybersecurity Framework 2.0 frames this as a governance and access discipline problem, not just an inventory problem, which is why evidence quality matters as much as the policy itself. See the NIST Cybersecurity Framework 2.0 and the Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.

• It normalises identities, roles, and entitlements so conflicts are evaluated across systems, not in isolated rows.
• It flags toxic combinations at the moment access is granted, modified, or renewed.
• It keeps an audit trail of who approved what, when the violation was detected, and how it was remediated.
• It supports compensating controls where a strict SoD rule cannot be eliminated immediately.

This matters because SoD is only effective when exceptions are visible and time-bound. Control platforms make remediation measurable, which helps security and compliance teams prove that a conflict was addressed rather than merely documented. These controls tend to break down in environments where identities are created outside central IAM, such as shadow IT, ad hoc automation, or unmanaged service accounts, because the platform cannot evaluate what it never ingests.

Common Failure Modes and Edge Cases

Tighter SoD enforcement often increases process overhead, requiring organisations to balance control strength against delivery speed. That tradeoff is real, especially in fast-moving finance, ERP, and DevOps environments where the same person may need temporary elevated access to keep operations running. Current guidance suggests that the answer is not to weaken SoD, but to make exceptions explicit, approved, and short-lived. There is no universal standard for exception design yet, so teams usually define local thresholds for expiry, review cadence, and compensating approvals.

Manual spreadsheets become especially fragile when roles overlap heavily, business units maintain local copies, or one identity has multiple access routes through groups, inherited permissions, and API keys. They also struggle when auditors ask for repeatable evidence across periods, because the spreadsheet captures intent more easily than enforcement. For teams working with non-human identities, the risk is even sharper: service accounts and automation identities can hold privileged access that never appears in the same workflow as human approvals, so the conflict is hidden unless the control model is continuous. The broader NHI governance problem is explored in the NHI Lifecycle Management Guide and the Ultimate Guide to NHIs — The NHI Market.

Where spreadsheet-based SoD breaks down most visibly is during rapid mergers, shared admin pools, or environments with many third-party integrations, because ownership, approval paths, and revocation timing all move faster than manual review can keep up.

Related resources from NHI Mgmt Group

• What breaks when teams try to clean source data inside the IAM platform instead of fixing it upstream?
• What is the difference between policy-based access control and manual access administration in IAM?
• What breaks when an IAM platform depends on custom code instead of configuration?
• What happens when onboarding and offboarding are still handled through manual IAM processes?