Topic starter
04/06/2026 6:48 pm
TL;DR: Weak segregation of duties lets employees, contractors, and privileged users complete sensitive processes without independent oversight, increasing fraud, audit failures, and hidden privilege abuse across finance, HR, cloud, and IAM workflows, according to SecurEnds. The core issue is not missing tools but governance that still allows one identity to control too much.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Why Segregation of Duties is Essential for Fraud Prevention”.
Key questions
Q: What breaks when segregation of duties is not continuously monitored?
A: Toxic combinations can persist unnoticed in privileged, financial, and regulated-data workflows.
Q: Why do conflicting permissions create audit and fraud risk in IAM?
A: Conflicting permissions let one identity complete sensitive actions without independent oversight, which weakens evidence, accountability, and fraud prevention.
Q: How do organisations know if SOD controls are actually working?
A: Look for two signals: risky requests being blocked before access is granted, and existing violations being found and remediated on a recurring schedule.
Practitioner guidance
- Build an SoD matrix for high-risk workflows Document incompatible combinations for payments, payroll, privileged administration, production changes, and access approval so governance teams can see where one identity can still complete a full sensitive process.
- Prioritise SoD controls in the highest-friction systems Start with finance, ERP, HR, IAM, cloud administration, and privileged access workflows, since those systems concentrate the most abuse potential and the most audit exposure.
- Run access reviews against toxic combinations Review whether users hold permissions that are individually acceptable but collectively violate separation rules, especially after role changes or temporary exception grants.
Bottom line: Weak segregation of duties allows a single identity to control multiple stages of a sensitive process, which increases fraud and hidden abuse risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 7:00 pm
Segregation of duties is now a control-integrity problem, not just a fraud-control checklist item. The article correctly shows that insider fraud often succeeds through legitimate access rather than intrusion. That changes the governance question from "who can log in" to "who can complete a sensitive process end to end". Practitioners should treat entitlement design as business control design.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: What should teams do immediately when they find an SoD violation?
A: Contain the violation by removing the conflicting privilege set, then review whether the same pattern exists elsewhere in finance, HR, IAM, or privileged access workflows. The immediate goal is to stop one identity from controlling the same process at multiple points before additional transactions or changes occur.
👉 Read our full editorial: Segregation of duties fraud prevention is an IAM control gap