When should organisations move from detective SoD review to preventive controls?

When detective SoD reviews are no longer enough

Detective segregation of duties works when conflicts are rare, reviewable, and can be corrected before they create meaningful exposure. The threshold to move on is not theoretical maturity, it is whether the organisation keeps finding the same toxic combinations or discovers them too late for the review to matter. At that point, SoD has become a provisioning problem, not just a monitoring problem.

A detective model can still be useful for assurance, but it should not be the primary safeguard once recurring conflicts show that downstream review is only confirming a failure pattern already in motion. That is especially true where the conflict can activate transactions, approvals, or release rights before a reviewer intervenes. For a deeper treatment of conflict patterns and mitigation options, see the Segregation of Duties (SoD) Guide.

What changes when the control moves upstream

preventive controls change the question from “Did someone notice the conflict?” to “Should this access be granted at all?” That means the check happens during provisioning, role assignment, privileged access approval, or workflow design, before the entitlement becomes usable. In practice, the organisation is shifting from after-the-fact assurance to pre-execution enforcement.

This shift matters because the control objective changes from evidence of review to prevention of exposure. A detective control can tell you that a bad combination existed; a preventive control blocks the combination or forces an exception path before activation. That is the right move when the same conflicts keep reappearing, when approval queues are slower than business changes, or when manual remediation cannot keep up with access creation.

The practical design choice is usually not “detective or preventive” in the abstract, but which access classes must be blocked outright, which can be exception-approved, and which can remain under review. Many organisations keep detective review for low-frequency or compensating scenarios while hardening the high-risk combinations upstream.

What good control design looks like in practice

Good preventive SoD design starts with the conflicts that are both high-impact and repeatable. Those combinations should be embedded into role design, joiner-mover-leaver workflows, and approval rules so they are evaluated before access is active. Where the business truly needs an exception, the exception should be explicit, time-bounded, and visible.

In mature programmes, review does not disappear. It becomes a backstop for edge cases, privileged exceptions, and evidence collection, while the default path is blocked or routed through additional approval. That is why preventive design is most effective when it is tied to the access request system, not left as a separate audit task.

Teams should also watch for role explosion. If preventive SoD is implemented poorly, organisations may create many narrow roles just to avoid conflicts, which can make administration brittle and still leave hidden combinations in exceptional access paths. The control is strongest when rules are clear, exceptions are rare, and the role model is maintainable.

Practitioner Guidance

What to prioritise: Move the highest-risk, highest-frequency conflicts into provisioning controls first. If a conflict repeatedly reappears in review, the review is telling you the role model or access workflow is wrong, not just that the reviewer needs to be faster.

What to verify: Confirm that preventive rules are enforced before access becomes active, including for temporary access, emergency access, and delegated approvals. If those paths bypass the control, the “preventive” design is only partial.

Decision rule: Keep detective review for residual and exception cases, but treat repeated conflicts or slow remediation as a trigger to redesign the upstream control. The more often a bad combination appears, the less defensible it is to rely on review alone.

Practitioner takeaway: The right transition point is when review keeps documenting the same exposure, because at that stage SoD is no longer being used to prevent risk, only to record it.

Related resources from NHI Mgmt Group

• When should organizations review access controls?
• Why do corrective controls matter when organisations already have preventive and detective security controls?
• How should organisations choose the right mix of preventive, detective, and corrective security controls?
• How do organisations operationalise NHI ownership at scale?