The control does not disappear, but it has to be compensated. If one person must perform conflicting steps, organizations should add an independent review, require documented approval for the exception, and keep evidence of that oversight. Without that documentation, the same person can both create and approve the transaction, leaving the organization exposed to audit findings and weak accountability.
Why small teams need a compensating control, not a pass
When separation of duties is hard to enforce in a small team, the control becomes a risk management problem rather than a binary yes-or-no rule. The key question is whether the exception is still independently reviewable, approved, and evidenced. A small team can tolerate overlap, but only if the organization deliberately adds another control point around the conflicted step.
That is why a documented exception matters. It turns an unavoidable staffing constraint into an accountable process, and it makes it clear who accepted the risk, for how long, and under what conditions.
What the compensating control must actually do
The compensating control should break the “same person did everything” pattern at the point of approval, not just at the point of execution. In practice, that usually means an independent reviewer confirms the transaction, the justification, and the supporting evidence before it is finalized. For governance-heavy access processes, NHIMG’s IAM and IGA Basics provides the broader context for approvals, access reviews, and entitlement control.
The control also has to be durable enough for audit and incident review. If the exception exists only in chat, oral agreement, or tribal knowledge, it does not meaningfully compensate for the missing separation. Written approval, timestamps, and a retained record of who reviewed what are what make the control real.
Why documentation and review reduce the blast radius
Segregation failures usually create two problems at once, misuse and weak evidence. When one person can both initiate and approve a sensitive action, the organization loses the ability to show that the transaction was independently challenged. That is why NHIMG’s Segregation of Duties (SoD) Guide is relevant to the exception model: it treats conflicts as something to manage and detect, not something to ignore when staffing is tight.
The practical goal is not perfect purity in the org chart. It is to preserve accountability, make exceptions visible, and ensure that a conflict cannot quietly become the normal operating state. The smaller the team, the more important it becomes to separate approval evidence from execution authority wherever possible.
Risk and Threat Considerations
When separation of duties is weakened, the main risk is not only fraud or misuse, it is also the loss of credible oversight. A single person controlling both sides of a sensitive workflow can conceal mistakes, bypass challenge, or create records that look compliant without being independently verified.
Failure mechanism: The same operator can create, change, and approve the transaction, so the control no longer blocks self-approval or surfaces an exception for review.
Impact: That creates audit findings, reduces accountability, and increases the chance that unauthorized or erroneous activity survives undetected until after damage is done.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-5 — Separation of Duties | Directly addresses compensating controls when duties cannot be separated. |
| AU-6 — Audit Review, Analysis, and Reporting | Supports evidence retention and review of exception approvals and transactions. | |
| Recommendation — Require independent approval and review where one person must perform conflicting steps. Retain and review approval evidence for conflicted transactions and exceptions. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Supports governance over who may perform and approve sensitive actions. |
| Recommendation — Define and enforce access and approval rules for conflicted workflows. | ||
Practitioner Guidance
Decision rule: If you cannot fully separate the duties, require an exception path that names the conflicted steps, the independent approver, and the expiry date of the exception. Treat any recurring exception as a control design issue, not just an operational inconvenience.
What to verify: Confirm that the reviewer is truly independent of the conflicting action, that the approval occurred before the transaction was completed, and that the evidence would satisfy audit or incident reconstruction without relying on memory.
Practitioner takeaway: In a small team, the real control is not perfect segregation, it is whether the exception still creates independent challenge, durable evidence, and a clear ownership trail.
Related resources from NHI Mgmt Group
- What happens when Separation of Duties is not enforced across the identity lifecycle?
- What happens when separation of duties is not enforced in cloud deployments?
- How should teams apply mitigating controls when ERP segregation of duties cannot be enforced fully in the application security model?
- Who is accountable when SaaS access cannot be fully enforced under zero trust?