Topic starter
28/04/2026 4:51 pm
TL;DR: Traditional segregation of duties controls flag conflicting entitlements but miss whether those permissions are actually used together, creating long detection windows and high false-positive rates, according to Oleria Security. Usage-aware SoD shifts identity governance from documentation to evidence, which makes compliance more defensible and fraud risk more visible.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Segregation of Duties: A Guide to Automated SoD”.
By the numbers:
- Weak internal controls drove 32% of occupational fraud cases, according to the ACFE's 2024 Report to the Nations cited by Oleria Security.
Key questions
Q: What breaks when segregation of duties is missing from privileged access?
A: When segregation of duties is missing from privileged access, the same administrator can create identities, assign elevated roles, and hide the evidence of what changed.
Q: Why does usage data matter for segregation of duties risk?
A: Usage data matters because a conflict becomes materially risky when the same person actually exercises both sides of a sensitive process.
Q: How do security teams know if SoD controls are actually working?
A: SoD controls are working only if live access state matches the approved separation model across systems.
Practitioner guidance
- Define SoD around business transactions Map the specific high-risk workflows where one person should not control both initiation and approval, then align SoD rules to those process steps rather than generic role names.
- Correlate entitlements with activity logs Join access assignments to actual usage across SaaS, cloud, and legacy systems so conflicting permissions can be evaluated in context instead of by entitlement alone.
- Prioritise finance and admin workflows Start with vendor setup, payment approval, and privileged administrative paths because those combinations carry the clearest fraud and misuse risk.
Bottom line: SoD programs that only check entitlements can satisfy policy requirements while still missing whether conflicting permissions are exercised together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 8:43 pm
Usage-aware segregation of duties is a behavioural control problem, not a policy documentation problem. Traditional SoD programs prove that incompatible entitlements exist in policy, but that does not establish whether those permissions are actually exercised together. The practical consequence is that organisations can pass audits while still carrying active fraud exposure. The discipline has to move from policy completeness to evidence of use.
A few things that frame the scale:
- Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should organisations prioritise continuous monitoring over periodic certification?
A: They should treat certification as necessary but insufficient, then prioritise continuous monitoring for controls that can fail quickly, especially access, identity, and third-party dependencies. Periodic certification still matters for governance, but only live validation shows whether the control is effective when the environment changes after the audit window closes.
👉 Read our full editorial: Usage-aware segregation of duties closes the audit-to-risk gap