Topic starter
07/06/2026 8:28 pm
TL;DR: As organizations add more applications and hybrid access paths, segregation of duties becomes harder to enforce consistently across ERP and business systems, according to Delinea’s 2026 roundup. The control now has to work as an operating discipline, not just an audit requirement, because weak application-level separation leaves risky combinations of access intact.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Top Segregation of Duties (SoD) solutions to know about in 2026”.
Key questions
Q: What breaks when segregation of duties is the only control in place?
A: SoD blocks some toxic combinations, but it does not clean up stale, unused, or orphaned access.
Q: When should organisations prioritise cross-application SoD over single-system controls?
A: They should prioritise it when core business workflows span multiple business applications and the same identity can request, approve, and execute steps in different systems.
Q: What signs show that SoD governance is failing in practice?
A: Common signs include users who can both create and approve transactions, admins who review their own privileged activity, recurring access creep, and unresolved toxic entitlement combinations.
Practitioner guidance
- Define SoD at the business-process level Map conflicts around end-to-end business activities such as create, approve, post, and pay, then trace where those steps live across ERP and adjacent applications.
- Centralise access and risk visibility Build a single view of entitlements and SoD conflicts across the applications that support finance, procurement, HR, and customer operations.
- Tie findings to workflow remediation Route SoD violations into approval and remediation workflows so conflicts are removed, constrained, or explicitly risk-accepted with evidence.
Bottom line: Segregation of duties is increasingly a cross-application governance problem, not a single-system configuration task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
07/06/2026 10:22 pm
Cross-application SoD is now the real control boundary: the old model assumed segregation could be enforced inside a single ERP. That assumption fails when finance, CRM, HR, and business workflows are split across separate applications with different permission models. The implication is that identity teams have to govern access combinations across the business process, not just within one platform.
A question worth separating out:
Q: How do security teams know if SoD controls are actually working?
A: SoD controls are working only if live access state matches the approved separation model across systems. Teams should verify that no identity can both initiate and validate the same sensitive transaction, and that exceptions are time-bound and independently reviewed. If certification reports look clean but operational workflows still allow self-approval, the control is failing.
👉 Read our full editorial: Segregation of duties tools in 2026: what changes for IAM
This post was modified 3 days ago by NHI Mgmt Group