SoD analysis is the review of access and duties to find conflicting combinations that should not sit with the same person or account. It compares entitlements, roles and approval paths against segregation rules so that one identity cannot both request and authorise, or create and release, the same sensitive action.
What SoD analysis actually checks
SoD analysis compares who can initiate, approve, modify, and release a sensitive action so that conflicting powers do not land in the same hands. It is less about job titles than about whether access paths, approval routes, and operational duties create a conflict that undermines control.
In practice, the review focuses on combinations such as request and approve, create and pay, or administer and audit. A conflict can exist even when it is spread across different roles if a single account, shared credential, or delegated workflow lets one actor bypass the intended separation.
Why segregation rules matter
Segregation rules turn policy intent into a testable control. Without them, access reviews can confirm that entitlements exist without revealing that the same person can complete an end-to-end sensitive process unchallenged.
That matters because many control failures are not caused by a single overly broad permission, but by a combination of individually acceptable entitlements that become dangerous when joined together. SoD analysis is designed to find those toxic combinations before they become a fraud path, an approval bypass, or an unchecked release path.
How conflicts are identified in access and workflow design
Effective analysis starts with the business action, not the system menu. The reviewer maps the critical step sequence, then checks whether the same identity can cross the boundary between incompatible steps in the same application, across integrated systems, or through a manual override path.
That means looking at roles, direct entitlements, emergency access, service accounts, and the approval chain as one access story. A well-designed review also considers whether a compensating control truly interrupts the conflict, or whether it only documents the exception after the fact.
For organisations that want a broader control reference, the Segregation of Duties guide is the natural companion to this topic because it covers rulesets, conflict handling, and mitigation patterns.
What good SoD analysis produces
The output should be more than a list of violations. Strong analysis tells you which conflicts are truly unacceptable, which ones are tolerated with mitigation, and which ones are false positives caused by how the process is modelled.
That distinction matters because overly noisy rules destroy trust in the review, while overly loose rules leave material exposure in place. The best SoD programmes are precise enough to support governance decisions, yet practical enough to fit real operating models and exception handling.
When the analysis is mature, it becomes a control for both prevention and review: it blocks unsafe combinations at design time and exposes drift when roles, entitlements, or workflows change over time.
Risk and Threat Considerations
SoD weaknesses create a direct path to fraud, abuse of authority, and unchallenged transactions because the same actor can control more than one side of a sensitive process. The risk is greatest where approval, creation, and release rights are spread across multiple systems or where emergency access overrides normal checks.
Failure mechanism: A conflicting entitlement set or workflow exception lets one identity both initiate and authorise the same business action, so the control that was meant to provide independent review is bypassed.
Impact: This can enable improper payments, unauthorised changes, concealment of error or fraud, and post-event disputes that are hard to reconstruct because the same actor influenced every stage.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-5 — Separation of Duties | Defines separation of duties directly for conflicting access and approval combinations. |
| AC-6 — Least Privilege | Limits each identity to the minimum access needed, reducing toxic duty combinations. | |
| AU-9 — Protection of Audit Information | Supports SoD by preserving records needed to detect and investigate conflicting actions. | |
| Recommendation — Apply AC-5 to separate conflicting duties and review exception handling for approved compensating controls. Use AC-6 to trim entitlements so no account can accumulate unnecessary conflicting powers. Protect audit records with AU-9 so conflicting actions remain reviewable after execution. | ||
Practitioner Guidance
Why practitioners should care: SoD analysis only works when the conflict model matches the real process, so ownership should sit with both security and the business process owner. If the rule set is built only from application roles, it often misses manual approvals, delegated access, and exception paths.
What to watch for: Repeated exceptions, emergency access that becomes routine, and role mining that clusters incompatible duties into a single access bundle are strong signs that the analysis needs refinement. The most useful programme treats SoD as a living control, not a one-time audit exercise.