Topic starter
04/06/2026 6:48 pm
TL;DR: Weak segregation of duties leaves one identity able to carry out sensitive steps without independent oversight, according to SecurEnds. Finance, HR, cloud, and IAM workflows then carry hidden conflict risk until governance removes the toxic combinations.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Why Segregation of Duties is Essential for Fraud Prevention”.
Key questions
Q: Why do conflicting permissions create audit and fraud risk in IAM?
A: Conflicting permissions let one identity complete sensitive actions without independent oversight, which weakens evidence, accountability, and fraud prevention.
Q: How do organisations know if SOD controls are actually working?
A: Look for two signals: risky requests being blocked before access is granted, and existing violations being found and remediated on a recurring schedule.
Q: What breaks when segregation of duties is not continuously monitored?
A: Toxic combinations can persist unnoticed in privileged, financial, and regulated-data workflows.
Practitioner guidance
- Build an SoD matrix for high-risk workflows Document incompatible combinations for payments, payroll, privileged administration, production changes, and access approval so governance teams can see where one identity can still complete a full sensitive process.
- Prioritise SoD controls in the highest-friction systems Start with finance, ERP, HR, IAM, cloud administration, and privileged access workflows, since those systems concentrate the most abuse potential and the most audit exposure.
- Run access reviews against toxic combinations Review whether users hold permissions that are individually acceptable but collectively violate separation rules, especially after role changes or temporary exception grants.
Bottom line: Weak segregation of duties allows a single identity to control multiple stages of a sensitive process, which increases fraud and hidden abuse risk.
Glossary terms: Segregation of Duties, Toxic Access Combination, Access Creep, Independent Oversight
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 19 hours ago by NHI Mgmt Group
04/06/2026 7:00 pm
Segregation of duties is now a control-integrity problem, not just a fraud-control checklist item. The article correctly shows that insider fraud often succeeds through legitimate access rather than intrusion. That changes the governance question from "who can log in" to "who can complete a sensitive process end to end". Practitioners should treat entitlement design as business control design.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: What should teams do immediately when they find an SoD violation?
A: Contain the violation by removing the conflicting privilege set, then review whether the same pattern exists elsewhere in finance, HR, IAM, or privileged access workflows. The immediate goal is to stop one identity from controlling the same process at multiple points before additional transactions or changes occur.
👉 Read our full editorial: Weak segregation of duties turns IAM into a fraud risk
This post was modified 19 hours ago by NHI Mgmt Group