Topic starter
17/08/2026 4:41 pm
TL;DR: Separation of duties remains a core internal control because conflicting access can let one person create and approve transactions, issue funds, or bypass review, according to Saviynt. The practical challenge is not defining SOD but enforcing it consistently across applications, users, and service accounts before violations become fraud or audit findings.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Separation of Duties: What it means for your business and how Saviynt can help”.
Key questions
Q: What breaks when separation of duties is not enforced in regulated environments?
A: High-risk actions become easier to execute without challenge, and the organisation loses a major control against both misuse and insider risk.
Q: Why do conflicting entitlements create so much fraud risk?
A: Because they remove the independent check that prevents one identity from completing both sides of a sensitive transaction.
Q: How should security teams detect segregation of duties conflicts that matter in practice?
A: They should correlate assigned entitlements with actual activity across systems, not just rely on role definitions.
Practitioner guidance
- Map toxic role combinations across critical processes Identify which entitlement pairs let one identity both initiate and complete a sensitive transaction, then document those pairs at the business-process level rather than per application.
- Apply SOD checks at request time Evaluate access requests against SOD policy before granting new entitlements, and route risky combinations to approval or rejection workflows.
- Extend SOD rules to service accounts Include automation accounts in the same conflict analysis used for human users so non-human access cannot bypass review by default.
Bottom line: Separation of duties fails when one identity can carry conflicting authority through a business process, especially across multiple applications.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Separation of duties is still a control integrity problem, not a policy declaration problem. Organisations often have SOD rules on paper but still allow conflicting access to accumulate across applications, users, and service accounts. The article shows that the real failure mode is inconsistent enforcement across the identity lifecycle. The practitioner takeaway is that SOD quality must be measured by prevented conflicts, not by the existence of a rule library.
A question worth separating out:
Q: Should organisations include service accounts in segregation of duties checks?
A: Yes. Any account that can perform sensitive actions should be subject to SoD logic, including service or unmapped accounts. If those accounts are excluded, the organisation creates a parallel access path that can bypass the same governance applied to human users.
👉 Read our full editorial: Separation of duties gaps still drive fraud and compliance risk