Why Segregation of duties matters to internal audit and controllers
The classic split separates approving a transaction, recording it, holding the asset and reconciling the records. One person holding two of these is a conflict.
Access SOD asks whether any user's ERP roles allow conflicting actions. Transaction SOD asks whether any user actually performed both steps on the same transaction.
Access reviews alone can mislead: a conflicting role may never have been used. Testing transactions shows what really happened.
Where small teams cannot separate duties, a compensating control is used, such as a monthly review of that user's activity.
An example
One user in procure to pay can create a vendor and approve a payment to it. A transaction test finds that the user did both for a few vendors in the year. Each case becomes an exception for review.
How IRAME handles it
IRA, IRAME's AI auditor, tests both access and transactions for SOD conflicts, alongside P2P, payroll, T&E and journal checks. In finance and accounts audits covering P2P, O2C, R2R and SOD, fieldwork fell from 15 man-days to about 4 man-hours.
See Internal audit or read the story: Finance and accounts audit across P2P, O2C, R2R and SOD.