Segregation-of-Duties Check¶
Control check — instantiates Overlap Exclusion Design
Reconciles who holds which duties against a matrix of incompatible role pairs, detecting any single actor who has accumulated two conflicting responsibilities that must never rest with one person.
Some overlaps are dangerous not because things share a member, but because a person does. Segregation-of-Duties Check is the detective control that finds them: it reconciles the current assignment of duties to actors against a declared matrix of incompatible role pairs, and flags any single actor who holds two responsibilities that must stay in different hands. Its defining subject is the actor–role relation and conflict of interest — not datasets, names, or states, but the specific hazard that one individual can both initiate and approve, or both custody and record. It runs as a periodic reconciliation that produces findings, and its point is to let an organization rely on the separation its structure claims.
Example¶
At a mid-size company, no one should be able to both create a new vendor in the finance system and approve payments to vendors — the combination lets a single person invent a payee and pay it. A Segregation-of-Duties Check runs against the ERP's access grants. It reads the register of duties and the incompatibility matrix (vendor-master maintenance is incompatible with payment approval, among other pairs) and reconciles it against who actually holds which entitlements. The reconciliation surfaces one employee who, after a role change, retained vendor-creation rights while gaining payment-approval rights — a live conflict that no single grant looked wrong in isolation.
The finding goes to management with the specific incompatible pair named. One of the two entitlements is removed, and the auditor can now state that the create-and-approve conflict does not exist in the population — the basis on which financial controls are relied upon.[n1]
How it works¶
- Maintain the incompatibility matrix — declare which duty pairs may never rest with one actor, and keep it current as processes change.
- Gather actual assignments — pull the real actor-to-entitlement grants from the systems of record.
- Reconcile — intersect each actor's held duties against the forbidden pairs; any actor holding both members of a pair is a violation.
- Report and attest — deliver findings with the specific conflict named, and, once cleared, attest that the population is free of the forbidden combinations.
Tuning parameters¶
- Matrix scope — how many incompatible pairs are tracked. Broader coverage catches subtler conflicts but generates more findings to clear.
- Run cadence — continuous monitoring versus periodic (quarterly) reconciliation. More frequent shrinks the window a conflict can persist but costs more review.
- Materiality threshold — whether every conflict is flagged or only those above a risk level; filtering reduces noise but can excuse small conflicts that compound.
- Compensating-control allowance — whether a conflict may be accepted when another control offsets it; flexible but easy to over-use as an excuse.
When it helps, and when it misleads¶
Its strength is catching the conflict that no single access grant reveals — the danger lives only in the combination, which only a reconciliation against the incompatibility matrix can see. It gives auditors and regulators a defensible basis for relying on the separation of authority. Its weakness is that it is only as good as the matrix: a missing incompatible pair is a conflict the check will never find, and because it is detective rather than preventive, a conflict can exist and be exploited in the window before the next run. The classic misuse is a stale matrix that reflects an old process while roles have evolved around it. The guarding discipline is to keep the matrix current with real workflows and to shorten the reconciliation window where the stakes justify it.
How it implements the components¶
collection_role_register— it maintains the register of duties and the incompatibility relation among them that the check reconciles against.overlap_detection_channel— the reconciliation is the detecting act: it is how a conflicting pair held by one actor is surfaced.no_shared_member_invariant— the invariant it verifies is that no actor is a member of two incompatible duty sets at once.downstream_use_boundary— a clean result is what lets auditors and management rely on the claimed separation of authority.
It does not apply the intake predicate that places an element, act as the assigning authority, or keep the running assignment log — membership_resolution_rule, assignment_authority, and membership_change_log belong to Single-Assignment Workflow, which prevents overlap at assignment while this check detects it after the fact.
Related¶
- Instantiates: Overlap Exclusion Design — detects violations of a no-shared-member invariant defined over actors and incompatible duties.
- Sibling mechanisms: Holdout Leakage Test · Mutual-Exclusion Constraint · Namespace Collision Scan · Overlap Exception Register · Overlap Matrix · Pairwise Intersection Audit · Quarantine and Reassignment Queue · Single-Assignment Workflow · State Exclusivity Table
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Segregation-of-Duties Check operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it reconciles who holds which duties against a matrix of incompatible role pairs, detecting any single actor who has accumulated two conflicting responsibilities that must never rest with one person.
Independent corroboration: The frozen evidence defines Segregation-of-Duties Check as 'Reconciles who holds which duties against a matrix of incompatible role pairs, detecting any single actor who has accumulated two conflicting responsibilities that must never rest with one person', so its operative form is Assessment, Review & Assurance.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Accounting & Auditing
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: The incompatible-role matrix directly descends from internal-control and audit doctrine for preventing fraud and undetected error by separating authorization, custody, and recording.
Related originating lineages:
- Economics & Finance — Economics, finance, and mechanism-design practice supplies a parallel or contributing lineage for the mechanism's defining operation: reconciles who holds which duties against a matrix of incompatible role pairs, detecting any single actor who has accumulated two conflicting responsibilities that must never rest….
- Law & Governance — Governance and compliance regimes institutionalize independent duties where concentrated authority creates conflicts.
- Organizational & Management Science — Organization design generalizes the same separation to authority, review, and operational responsibilities.
Review resolution: The blind reviewers agree that accounting_auditing is the primary origin and differ only on alternate origin disagreement, encyclopedia synthesis disagreement. I preserve every independently explained alternate from both records rather than imposing a numeric cap. I retain single_lineage because the combined record shows one traceable formative lineage. The broader reach of multi_domain records portability separately from historical provenance, and encyclopedia_synthesis=true preserves the affirmative synthesis judgment where either reviewer identified one.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] Segregation of duties (the four-eyes principle) holds that no single person should control every step of a sensitive transaction — for example, both creating a payee and approving its payment. It is a specific application of overlap exclusion to the assignment of authority, aimed at removing the opportunity for undetected fraud or error. ↩