Cross-system SoD gaps: what IAM and audit teams are missing

TL;DR: Cross-system segregation of duties failures emerge when initiation, approval, reconciliation, and release are split across different platforms, allowing a single identity to complete a high-risk workflow without tripping any one system’s controls, according to Gathid. The governance gap is structural, not procedural, because isolated compliance checks do not reveal how authority combines across the enterprise.

NHIMG editorial — based on content published by Gathid: Segregation of Duties across systems and the hidden fraud risk

Questions worth separating out

Q: What breaks when segregation of duties is the only control in place?

A: SoD blocks some toxic combinations, but it does not clean up stale, unused, or orphaned access.

Q: Why do cross-system SoD violations create fraud risk even when access reviews pass?

A: Access reviews usually validate entitlements in isolation, not how those entitlements combine across platforms.

Q: How can security teams detect SoD gaps that span multiple applications?

A: They need process-aware analysis that traces the complete business transaction across systems, identities, and integrations.

Practitioner guidance

• Map end-to-end control loops Identify the full initiation, approval, execution, and reconciliation path for each high-risk process, then test whether any single identity can traverse all steps across different systems.
• Include service and integration accounts in SoD reviews Treat non-human identities that bridge applications as first-class participants in segregation analysis.
• Augment access certification with pathway testing Keep access reviews, but add tests that answer a different question: can this identity complete the prohibited sequence even if no single entitlement looks abnormal? Use scenario-based reviews to uncover cross-system combinations that pass local policy but fail process separation.

What's in the full article

Gathid's full analysis covers the operational detail this post intentionally leaves for the source:

• How to map end-to-end SoD workflows across ERP, procurement, finance, and integration layers
• Examples of cross-system authority combinations that create hidden fraud pathways
• Why local access reviews can pass while process-level separation still fails
• Practical steps for turning SoD from a compliance exercise into a control-design test

👉 Read Gathid's analysis of cross-system segregation of duties risk →

Cross-system SoD gaps: what IAM and audit teams are missing?

Explore further

View Full Forum →  |  NHI Foundation Course →