Topic starter
25/06/2026 12:58 am
TL;DR: Segregation of duties checklists help organisations map critical processes, identify toxic access combinations, and move from detective review to preventive controls across ERP, HCM, and CRM systems, according to Delinea and the Association of Certified Fraud Examiners. The governance gap is not awareness but repeatability: access conflicts keep reappearing unless review, escalation, and provisioning are tied together.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Segregation of Duties checklist for robust internal controls”.
By the numbers:
- Incidents of fraud occur due to a lack of internal controls 32% of the time, according to the Association of Certified Fraud Examiners cited by Delinea.
Key questions
Q: What breaks when segregation of duties checks are handled outside the provisioning workflow?
A: When SoD checks sit outside provisioning, conflicts can be introduced before anyone notices, or approved later without full context.
Q: Why do SoD conflicts keep recurring in ERP and HCM workflows?
A: They recur because the control is often documented once but not embedded into the access path.
Q: How should IAM teams decide which access combinations need SoD rules?
A: Start with business processes that carry financial, operational, or regulatory risk, then identify the specific duties and approvals within each workflow.
Practitioner guidance
- Map critical business processes first Inventory the ERP, HCM, and CRM workflows that handle sensitive approvals, payments, or master data before writing any conflict rules.
- Build a conflict ruleset from duty combinations Document the specific access combinations that should never coexist in one user profile, then review them with application owners and audit.
- Tie SoD review to provisioning workflows Check SoD before access is granted so toxic combinations are blocked or routed for approval before they become active.
Bottom line: Segregation of duties breaks down when toxic access combinations are discovered after provisioning instead of being blocked in the access path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:06 am
SoD fails when access review is detached from provisioning: The control assumption is that conflicts will be caught before they matter, but that assumption collapses when conflicting access can be granted first and assessed later. In that model, review becomes a record of failure rather than a prevention mechanism. The implication is that SoD must be treated as an access-path control, not a post-hoc audit activity.
A question worth separating out:
Q: When should organisations move from detective SoD review to preventive controls?
A: They should move as soon as the same high-risk conflicts keep reappearing in review cycles or the review cadence is too slow to prevent exposure. At that point, the control has to shift upstream into provisioning so access is evaluated before it becomes active.
👉 Read our full editorial: Segregation of duties in identity governance: closing access conflict gaps