A SoD exemption is a documented exception that allows a person to hold or use access that would normally conflict with segregation of duties controls. It is typically time-bound, approved by accountable managers or risk owners, and tracked so conflicting entitlements, privileged access, or transaction approval rights can be reviewed and removed.
What a SoD exemption actually changes
A Segregation of Duties exemption does not remove the control, it authorises a controlled exception to it. That means the organisation is accepting a documented conflict between access and authority, usually because a role, process, or incident-response need cannot be operated cleanly under standard SoD rules.
The key security difference is that the exception becomes part of the control design. A good exemption is explicit about who approved it, what conflict exists, how long it lasts, and what compensating control makes the risk acceptable. Without those guardrails, an exemption becomes a quiet policy bypass rather than a managed exception.
Where SoD exemptions appear in practice
SoD exemptions usually appear in workflows that need temporary or exceptional access, such as emergency production support, end-of-period finance operations, system recovery, or small-team environments where strict role separation is hard to maintain continuously. They are often used when one person must perform steps that would normally be split across request, approval, and execution.
The problem is not the exception itself, but the drift that follows it. Exemptions can accumulate, remain active after the original need ends, or be reused as a convenience pattern. That is why exemption records should be tied to a specific use case, scope, and expiry, rather than treated as a standing entitlement.
NHIMG’s Segregation of Duties (SoD) Guide is the best place to understand how SoD rulesets, toxic combinations, and compensating controls fit together.
Why SoD exemptions matter to control assurance
SoD is meant to reduce fraud, error, and self-approval risk by making sure no single actor can complete an end-to-end sensitive process unchecked. An exemption weakens that protection unless it is paired with compensating oversight, such as independent review, dual approval, or transaction monitoring.
That is why exemptions should be treated as governance events, not just access changes. They affect auditability, accountability, and the reliability of the control environment. In regulated or high-trust workflows, even a valid exemption can create a material control gap if the organisation cannot show why it was granted and how it was monitored.
How teams should think about removal and review
The practical lifecycle question is whether the exemption is still needed. Every SoD exemption should be reviewable against an end date, a current business justification, and the continued presence of a compensating control. If the original condition has passed, the exemption should be removed rather than renewed by default.
This is especially important where the exempted access also includes privileged permissions, approval rights, or transaction execution rights. Those combinations can create the exact conflict SoD was designed to prevent, so the review process should look for both the access itself and the business process that depends on it.
Risk and Threat Considerations
SoD exemptions increase exposure when they become permanent, overbroad, or poorly tracked. They can also be abused by insiders or attackers who compromise an account that already holds conflicting rights, because the exemption can bypass a control that would otherwise force separation of actions.
Failure mechanism: A documented exception erodes control integrity when the conflict is not time-bound, independently reviewed, or paired with effective monitoring, allowing one user to initiate, approve, and complete sensitive actions.
Impact: The result can be fraud, unauthorized changes, hidden self-approval, weaker audit evidence, and a larger blast radius if the exempted account is compromised.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-5 — Separation of Duties | Defines SoD as a control principle and exception handling problem. |
| AC-6 — Least Privilege | Exemptions often expand access beyond minimum needed, creating excess privilege. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | SoD exemptions require monitoring and review of the actions performed under the exception. | |
| Recommendation — Document and review SoD exceptions under AC-5 so conflicting duties stay controlled and time-limited. Limit exemption scope to the minimum access needed and remove it as soon as the need ends. Review activity performed under SoD exemptions and investigate unusual or self-approved transactions. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | SoD exemptions are an access-control exception that must be governed and justified. |
| A.5.18 — Access rights | Exemptions change who may perform conflicting actions and must be reviewed as access rights change. | |
| Recommendation — Apply access-control policy to approve, scope, and expire SoD exemptions. Review access rights regularly so exempted conflicting permissions do not persist unnoticed. | ||
Practitioner Guidance
Governance implication: Treat SoD exemptions as risk-accepted control exceptions with named ownership, not as informal access shortcuts. The exemption record should show the conflicting entitlements, the approval authority, the expiry condition, and the compensating control that makes the exception tolerable.
What to watch for: The highest-risk exemptions are broad, recurring, or never revisited. If the same exception is repeatedly renewed, it usually means the underlying process design has not been fixed and the exemption has started to function like a standing privilege.