What breaks when organisations only review segregation of duties at audit time?

Why This Matters for Security Teams

segregation of duties only helps when it is checked while access is being granted, changed, or used. If organisations wait until audit time, the control becomes retrospective evidence gathering instead of active risk reduction. That means a person may approve, create, and reconcile the same transaction path for weeks or months before anyone notices the conflict.

This is where the gap between policy and operations becomes visible. Audit teams can confirm that a conflict existed, but they cannot stop the downstream effects already embedded in approvals, journal entries, or privileged workflows. NIST CSF 2.0 treats governance as an ongoing discipline, not a year-end exercise, and NIST SP 800-53 Rev. 5 expects access and separation controls to be enforced continuously, not merely documented after the fact. NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives and Top 10 NHI Issues show how hidden privilege overlap and weak visibility turn control reviews into cleanup work.

In practice, many security teams encounter segregation failures only after a disputed approval, an exception flood, or a failed attestations cycle has already exposed the issue.

How It Works in Practice

Continuous segregation of duties works by evaluating conflicts at the point of change and at the point of use, not just during periodic certification. That usually means combining identity data, role definitions, application entitlements, workflow ownership, and transaction context in one control view. NIST CSF 2.0 supports this kind of ongoing governance, while NIST SP 800-53 Rev. 5 provides the control language for enforcing least privilege, authorization review, and separation across systems.

The operational pattern is straightforward:

• Define conflict rules for roles, duties, and approval paths before access is granted.
• Check new entitlements against those rules when provisioning occurs.
• Monitor for temporary exceptions, emergency access, and toxic role combinations.
• Trigger remediation when a conflict is introduced, not only when it is reported.
• Retain evidence of the decision, compensating control, and owner approval for audit traceability.

For NHI-heavy environments, the same logic applies to service accounts, API keys, automation pipelines, and agentic workloads that can execute approvals or transactions without human intervention. NHIMG’s NHI Lifecycle Management Guide and Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs are relevant because privilege conflicts often begin with overbroad machine access that never gets revalidated after onboarding.

Best practice is evolving toward automated policy checks in IAM, PAM, ticketing, and CI/CD rather than annual spreadsheet reviews. These controls tend to break down when organisations have shared admin roles, manual override culture, or disconnected systems because the conflict is invisible at the exact moment the risky action is approved.

Common Variations and Edge Cases

Tighter segregation controls often increase operational friction, requiring organisations to balance strong approval boundaries against business continuity and exception handling. That tradeoff is real, especially in finance, healthcare, and critical operations where dual control is necessary but emergency access still has to work.

There is no universal standard for how often every conflict must be rechecked, but current guidance suggests the review cadence should match change velocity. High-churn environments need continuous or near-real-time checks, while slower systems may tolerate scheduled reviews if compensating controls are strong and documented.

Common edge cases include break-glass access, inherited entitlements from group membership, and shared non-human identities used by multiple services. In those cases, the control question is not only “who has access?” but also “can a single identity complete an entire prohibited workflow path?” That is why audit-time review alone is insufficient: it can confirm the conflict existed, but it cannot prove the environment was protected while the conflict remained active.

For broader context on recurring risk patterns, NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks helps teams separate one-off exceptions from systemic control design failures.

Related resources from NHI Mgmt Group

• What breaks when access reviews and segregation of duties are still handled manually at enterprise scale?
• How should organisations improve SAP access governance when native segregation-of-duties controls only show technical violations?
• What breaks when retail organisations do not monitor identity behaviour in real time?
• What breaks when organisations rely on manual review to find secrets in code and endpoints?