Topic starter
10/06/2026 9:43 pm
TL;DR: Segregation of duties remains a core control for compliance and fraud prevention, but it breaks down when roles overlap, approvals concentrate, or access reviews lag behind organisational change, according to Zluri’s 2026 analysis. The practical issue is not the policy itself, but whether identity governance can keep pace with real-world privilege drift.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Segregation of Duties (SoD) Risks to Address in 2026”.
Key questions
Q: What breaks when separation of duties is not enforced in IAM governance workflows?
A: When separation of duties is weak, the same person can request, approve, and retain conflicting access, which undermines control integrity.
Q: How often should organisations run a segregation of duties analysis in a dynamic environment?
A: The right cadence depends on how much change the organisation introduces.
Q: How do teams know whether an SoD programme is actually working?
A: An SoD programme is working when conflicting access is prevented at provisioning, surfaced during certification, and removed quickly when role changes occur.
Practitioner guidance
- Map conflicting access paths Identify where one identity can both create and approve sensitive transactions, then remove those entitlement combinations from business-critical workflows.
- Reconcile inherited access after mergers Treat post-merger roles, approvals, and admin rights as provisional until every conflicting privilege has been reviewed and either remediated or formally justified.
- Tie SoD to lifecycle events Trigger certification and exception review when employees move roles, join new teams, or leave functions that formerly granted authority over the same process.
Bottom line: Segregation of duties fails most visibly when a single identity can both approve and execute the same sensitive workflow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 5:42 am
SoD is failing less because organisations lack policy and more because identity governance is lagging organisational change. The article describes a familiar control trap: roles change faster than access models, so conflicting entitlements survive long after the business process has moved on. The practitioner lesson is that SoD has to be governed as a live entitlement state, not a compliance document.
A question worth separating out:
Q: What should security teams do when role overlap creates SoD conflicts?
A: Security teams should remove the overlapping privileges first, then redesign the approval and certification path so the conflict cannot reappear. That means separating execution from approval, tightening exception handling, and aligning access reviews to the actual job change that created the conflict.
👉 Read our full editorial: Segregation of duties risks in 2026 expose IAM control gaps
This post was modified 4 days ago by NHI Mgmt Group