Topic starter
28/07/2026 6:15 pm
TL;DR: Cross-system segregation of duties failures emerge when initiation, approval, reconciliation, and release are split across different platforms, allowing a single identity to complete a high-risk workflow without tripping any one system’s controls, according to Gathid. The governance gap is structural, not procedural, because isolated compliance checks do not reveal how authority combines across the enterprise.
Editorial analysis by NHI Mgmt Group, based on content published by Gathid: “How Cross-System SoD Violations Create Fraud Paths No One Can See”.
Key questions
Q: What breaks when segregation of duties is the only control in place?
A: SoD blocks some toxic combinations, but it does not clean up stale, unused, or orphaned access.
Q: Why do cross-system SoD violations create fraud risk even when access reviews pass?
A: Access reviews usually validate entitlements in isolation, not how those entitlements combine across platforms.
Q: What are the signs that Segregation of Duties is failing in an organisation?
A: Common signs include one user holding both initiation and approval rights, repeated exceptions to workflow rules, weak audit trails, and access that does not match job responsibilities.
Practitioner guidance
- Map end-to-end process authority Trace initiation, approval, reconciliation and release across every system that participates in the workflow, then test whether one identity can complete the sequence.
- Review cross-application entitlements together Combine role, group, integration and service account data into one view so reviewers can detect compound access that no single system exposes.
- Add process-level SoD tests to certification Require recertification to answer whether the user can still execute a prohibited business sequence across systems, not just whether each entitlement is individually justified.
Bottom line: Cross-system SoD failures happen when individually valid permissions combine into an end-to-end workflow that no single application can see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:53 pm
Cross-system SoD failure is an authority-structure problem, not an access-list problem. Enterprises often believe their controls are strong because each application can enforce separation locally. That view breaks down once identities, groups, integrations and workflows span multiple systems. Practitioners need to treat authority as a graph across the business, not as a set of discrete application permissions.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: How should IAM and audit teams govern SoD across connected platforms?
A: They should move from system-level rule checks to process-level authority mapping. That means reviewing the full workflow, the identities that can touch it, and the combinations of roles, groups and integrations that complete it. The question is not whether each system is clean, but whether any identity can finish a high-risk process end to end.
👉 Read our full editorial: Cross-system segregation of duties is the hidden fraud risk