Usage-aware segregation of duties closes the audit-to-risk gap

At a glance

What this is: This is an analysis of why entitlement-based segregation of duties misses real risk when conflicting permissions exist on paper but are never exercised together.

Why it matters: It matters because IAM, IGA, and PAM teams need controls that prove whether risky access is actually used, not just whether it was assigned.

By the numbers:

• Weak internal controls drove 32% of occupational fraud cases, according to the ACFE's 2024 Report to the Nations cited by Oleria Security.

Context

Segregation of duties is an identity governance control that separates incompatible actions so one person cannot complete a high-risk transaction alone. In practice, the control fails when access policy is treated as evidence of risk instead of actual usage, especially across finance, HR, IT, and development workflows.

The core governance gap is that many organisations certify entitlements on a schedule, but business processes change continuously. That leaves long windows where conflicting access exists without detection, and the audit trail can look compliant while the operational risk remains intact.

Usage-aware segregation of duties closes the gap between policy and behaviour. It shifts the question from who holds both permissions to who actually exercises them together, which is the difference between documentation and defensible control evidence.

Key questions

Q: What breaks when segregation of duties is missing from privileged access?

A: When segregation of duties is missing from privileged access, the same administrator can create identities, assign elevated roles, and hide the evidence of what changed. That removes independent oversight and makes misuse much harder to detect. In practice, privileged access without SoD turns one control plane into a single point of failure.

Q: Why does usage data matter for segregation of duties risk?

A: Usage data matters because a conflict becomes materially risky when the same person actually exercises both sides of a sensitive process. That is how teams distinguish theoretical policy violations from active fraud exposure. Without activity context, every conflicting role looks equally urgent, even when one side has never been used.

Q: How do security teams know if SoD controls are actually working?

A: SoD controls are working only if live access state matches the approved separation model across systems. Teams should verify that no identity can both initiate and validate the same sensitive transaction, and that exceptions are time-bound and independently reviewed. If certification reports look clean but operational workflows still allow self-approval, the control is failing.

Q: Should organisations prioritise continuous monitoring over periodic certification?

A: They should treat certification as necessary but insufficient, then prioritise continuous monitoring for controls that can fail quickly, especially access, identity, and third-party dependencies. Periodic certification still matters for governance, but only live validation shows whether the control is effective when the environment changes after the audit window closes.

Technical breakdown

Why entitlement-only SoD checks miss real risk

Traditional SoD engines work from role and entitlement data, then compare it against a rule set that defines incompatible combinations. That model can detect a user who is provisioned with both create-vendor and approve-payment rights, but it cannot tell whether those rights were ever used in the same transaction flow. The result is a static compliance view that often overstates risk while missing the behavioural context that matters for fraud detection. In IGA terms, the control is auditable, but not evidence-based.

Practical implication: treat entitlement conflicts as a starting signal, not the final control verdict.

How usage-aware SoD changes detection mechanics

Usage-aware SoD adds activity telemetry to entitlement analysis. Instead of relying only on what access a user has, it correlates actual function use across systems, looking for frequency, recency, and context. That distinction matters because a conflicting entitlement that is never exercised is different from one used repeatedly within a short operational window. The architecture usually depends on unified identity data and cross-application visibility, because dangerous combinations often span SaaS, cloud, and legacy systems.

Practical implication: integrate access activity data with entitlement records so conflict logic reflects what people actually do.

Why cross-system visibility matters for SoD governance

The hardest SoD violations are often distributed across platforms. One system may create the transaction, another may approve it, and neither system alone shows the full picture. That makes manual policy mapping fragile and creates blind spots that periodic certification cannot close. A graph-based identity view is useful here because it can connect permissions and activity across environments and reveal combinations that would otherwise appear unrelated. This is where legacy IGA commonly breaks down: the control boundary is narrower than the business process.

Practical implication: map SoD conflicts across systems, not just inside each application silo.

Threat narrative

Attacker objective: The attacker objective is to use legitimate access paths to create or approve fraudulent transactions without detection.

1. Entry occurs when a user receives two individually legitimate permissions through normal role changes over time, such as create-vendor and approve-payment access.
2. Credential or privilege exposure becomes meaningful when the conflicting rights are retained long enough for the same person to exercise both sides of a sensitive workflow.
3. Impact occurs when the user can execute or conceal a fraudulent transaction without a second person interrupting the process.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Usage-aware segregation of duties is a behavioural control problem, not a policy documentation problem. Traditional SoD programs prove that incompatible entitlements exist in policy, but that does not establish whether those permissions are actually exercised together. The practical consequence is that organisations can pass audits while still carrying active fraud exposure. The discipline has to move from policy completeness to evidence of use.

Static certification cycles create a control window that is too wide for modern access drift. When SoD checks only happen at provisioning time or during periodic reviews, a conflict can persist for months before anyone notices. That is not a minor tuning issue; it is a structural blind spot in governance design. Identity teams should treat the review cadence itself as part of the risk surface.

Cross-application SoD is where the old model breaks first. The business process often spans multiple systems, while the rule set is still built around individual applications. That mismatch produces both false positives and false negatives, because the control does not understand the full transaction path. Practitioners need to govern the process, not just the local entitlement.

Usage-aware SoD turns identity governance into a risk-ranking discipline. Once activity data is available, the organisation can distinguish a theoretical conflict from one used in a live workflow, which changes prioritisation, remediation, and audit evidence quality. That is why the case for evidence-based SoD is really a case for making identity governance operational instead of procedural.

Audit-to-risk gap: SoD controls that rely on entitlements alone were designed for a world where policy state was a reasonable proxy for behaviour. That assumption fails when access accumulates through role creep and business processes evolve faster than certification cycles. The implication is that governance must be judged by observed use, not by the existence of an incompatible role pair.

From our research library:

• Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
• Read next: IAM and IGA Basics

What this signals

Usage-aware SoD is a signal quality problem. When identity governance is driven by entitlement state alone, teams spend time proving that conflicts exist instead of proving that they matter. The practical shift is to detect behaviour at the point of use, where risk becomes observable and remediation can be targeted.

Cross-system activity correlation is now the differentiator. Organisations with finance, HR, and admin processes spread across multiple platforms will not get reliable SoD outcomes from a single-system control view. The identity programme has to see the transaction path end to end, or it will keep missing the real conflict boundary.

For practitioners

• Define SoD around business transactions Map the specific high-risk workflows where one person should not control both initiation and approval, then align SoD rules to those process steps rather than generic role names.
• Correlate entitlements with activity logs Join access assignments to actual usage across SaaS, cloud, and legacy systems so conflicting permissions can be evaluated in context instead of by entitlement alone.
• Prioritise finance and admin workflows Start with vendor setup, payment approval, and privileged administrative paths because those combinations carry the clearest fraud and misuse risk.
• Replace periodic review as the primary detector Use continuous monitoring to surface conflicts as they emerge, then reserve certification for governance confirmation rather than first-line detection.
• Automate revocation for unused conflicts Remove conflicting permissions that have not been exercised in the recent operating period, and route active conflicts for human review with evidence attached.

Key takeaways

• SoD programs that only check entitlements can satisfy policy requirements while still missing whether conflicting permissions are exercised together.
• The article ties weak internal controls to 32% of occupational fraud cases, underscoring why visibility into actual access use matters.
• Usage-aware detection improves prioritisation because teams can focus remediation on conflicts that are active in real workflows.

Key terms

• Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
• Usage-aware SoD: Usage-aware SoD is an identity control that evaluates whether conflicting permissions are actually used in combination, not merely assigned on paper. It reduces false positives by tying access entitlements to observed behaviour across systems, which makes the control more accurate for modern enterprises with changing roles and distributed applications.
• Role Creep: Role creep is the gradual expansion of access as roles accumulate exceptions, inherited permissions, and obsolete entitlements. It is a common failure mode in large organisations because roles are often easier to add to than to redesign, review, or retire, which increases both audit burden and attack surface.
• Cross-system visibility: Cross-system visibility is the ability to trace identity activity, entitlement state, and lifecycle changes across multiple platforms in one coherent sequence. Without it, investigations and access reviews rely on manual correlation, which weakens accountability and slows response.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.