Internal Controls and Segregation of Duties

A CFO or CEO that violates SOX regulations by manipulating the company’s financial statements is one example of an SoD violation. Another example is an employee who embezzles funds by altering the purchase order they both created and signed. Process descriptions may be described at a closer level of detail in the enterprises. Scope
In the literature about SoD, there is not much discussion about scoping SoD requirements.

• The objective of Segregation of Duties is that no one person is given control over a process where they can miss errors, falsify information, or commit fraud.
• The primary purpose of the SoD model is to prevent intentional violations—unethical or criminal actions by company employees, usually for personal gain.
• Mitigating these risks is by far the biggest benefit gained from the segregation of duties.
• For instance, one person can make an order from a supplier, but a different person needs to record the transaction for that order.

This matrix is not an industry standard, just a general guideline suggesting which positions should be separated and which require compensating controls when combined. According to PWC’s 2022 Global Risk Survey, 56% of business leaders are investing in risk culture and reducing behavioral risk. To successfully segregate incompatible duties, your team must first understand the nature of all processes, roles, and tasks performed by the business. Many organizations create a visual representation of processes, helping map activities and duties to roles within their workflow. Role engineering, which defines position access rights and responsibilities and enterprise resource planning (ERP), can help clarify business roles and duties.

What are some examples of Segregation of Duties?

Ensuring that the AI aligns with an organization’s values and objectives is crucial for maintaining trust and security. Two crucial concepts that play an instrumental role in achieving these goals are Internal Controls and Segregation of Duties (SoD). In this fourth installment of our SoD blog series “Top Ten SoD, Google Searches Answered,” we discuss the significance of these concepts and unravel how they collectively fortify the foundation of your business integrity. Blockchain is a record-keeping technology designed to make it impossible to hack the system or forge the data stored on it, thereby making it secure and immutable. We are the American Institute of CPAs, the world’s largest member association representing the accounting profession. Today, you’ll find our 431,000+ members in 130 countries and territories, representing many areas of practice, including business and industry, public practice, government, education and consulting.

SOD controls require a thorough analysis of all accounting roles with the segregation of all duties deemed incompatible. For example, someone responsible for inventory custody can’t also oversee transactional recordkeeping regarding inventory. Proper internal controls are essential when ensuring accurate financial reporting and stopping fraud.

Examples of Unintentional Segregation of Duties Conflicts

It is essential to perform period reviews of access to ERP and other critical business systems, and perform a third-party review of access, to identify hidden conflicts. Additionally, investigating the role definitions themselves may often unearth sources of potential risk, as roles can be created with SoD conflicts already living within them. When embracing the latest AI innovations and integrating them with business applications, it’s crucial to ensure the security of the underlying technology platform, its connection to data sources and the application that serves it.

The importance of segregation of duties and how it works to help prevent errors and fraud is simple enough to understand. The X-axis would list only the specific procedures (Create requisition, Authorize requisition, Create order, Authorize order). Each user role would be rated low, medium, or high risk related to performing a particular procedure. In this purchasing example, User 1, whose primary duty is requisition creation, would rate as high risk performing requisition authorization. Ideally, each user role matches one procedure in the process workflow to minimize risk.

Key Concepts and Control Examples

Successfully managing risk across the enterprise is undoubtedly one of the stiffest challenges faced by today’s security professionals. Threats come in many forms and from varying angles, with the risk often raised or lowered by different structural scenarios or behavior patterns within your organization. One such scenario would be allowing one person or group within your organization complete control over a business process or multiple steps within that process. Processes as Scoping Boundaries
A second boundary may be created by the processes that transform the assets or their status. Again, such boundaries must be assessed to determine if they introduce any residual risk.

Greater accuracy and reliability of financial records

Segregation of Duties (SOD) is a basic building block of sustainable risk management and internal controls for a business. The principle of SOD is based on shared responsibilities of a key process that disperses the critical functions of that process to more than one person or department. Without this separation in key processes, fraud and error risks are far less manageable. Imagine what would happen if the keys, lock and code for a nuclear weapons system were all in the hands of one person! Emotions, coercion, blackmail, fraud, human error and disinformation could cause grave and expensive one-sided actions that can’t be corrected.

The operations manager came under severe scrutiny and corporate staff auditors were dispatched to the distribution center. At this point, the operations manager stopped showing up for work and was not returning phone calls. Thus, it can be said that in SoD, the scope may be limited to a process or a set of processes that creates an asset or transforms it, bringing the asset itself from one stable state to another stable state. Roles are rated low, medium, or high risk regarding performing a particular procedure.

The idea is to prevent the release of unauthorized code, whether it’s done maliciously or accidentally. Another example is in a warehouse, where the person receiving goods from a supplier and the person authorizing payment to the supplier are two different employees. Similarly, the person maintaining inventory records does not physically control the inventory, which reduces the possibility of inventory theft or incorrect reporting.

This may generate confusion when checking to see if there has been some kind of conflict in the attribution of duties. For example, figure 3 shows a schematic example of a fictitious accounts receivable process. It is only a part of the process and is grossly simplified, but it helps to illustrate this point. This alternate model encompasses some management duties within the authorization of access grant and segregates them from the other duties. For effective risk management, no one person or department should hold responsibility in multiple categories.

This key element must be kept in mind when assessing potential conflicts and designing rules. The SoD implementation tested for this article listed more than 80 potential SoD conflicts, along tips to using credit cards wisely with the compensating controls that had been applied to reduce risk to acceptable levels. Each of the actors in the process executes activities, which apparently relate to different duties.