Separation-of-Duties Review¶
Governance procedure — instantiates Antagonism Screening and Separation
Prevents one actor or role combination from holding powers that interfere destructively with accountability, oversight, or independent judgment.
A Separation-of-Duties Review examines who holds which powers and prevents any single actor — or a collusive pair — from accumulating a combination of duties whose union destroys the check one is supposed to provide on the other. Its defining move is that it operates on authority assignments: it breaks a dangerous concentration of power by restructuring who does what, and, where a small team cannot split the duties, it runs an accountable exception lifecycle instead of quietly tolerating the conflict. It does not display the conflict or wall anything off physically; it redesigns the role-to-power map so the toxic combination cannot form, and it watches for the map drifting back.
Example¶
In a company's procure-to-pay process, three powers matter: creating or editing a vendor record, approving a purchase, and releasing the payment. Held together by one person, they form a fraud pathway — that actor can invent a fake vendor, approve a purchase to it, and pay it, with no independent eyes on any step. A separation-of-duties review maps the powers each role actually holds and finds that a junior accountant's system access grants both vendor-master edit and payment release — a toxic pair. The primary control is a redesign: vendor-master changes move to a separate data-governance role, and payment release now requires a second approver, so no one actor spans the pathway. In a three-person startup finance team where a clean split is impossible, the review instead grants a bounded exception — the combination is permitted, but with compensating controls (an independent monthly bank reconciliation by the CFO, a hard dollar threshold above which a board member co-signs) and a fixed re-review date. Either way, the review then monitors for access drift: a new system role that silently re-merges the two powers is flagged before it becomes a standing hole.[n1]
How it works¶
The procedure enumerates duties and the actors who hold them, then defines which combinations are incompatible — the toxic-authority set (initiate-and-approve, custody-and-recordkeeping, edit-and-release). Its primary resolution is structural: reassign powers so no actor spans an incompatible pair. Where the organization is too small to fully separate them, it does not simply accept the risk; it routes the combination through an exception path with an accountable owner, compensating controls, a time limit, and mandatory post-use review. And because access quietly accumulates, it monitors for the conflict re-forming — new grants, inherited roles, exceptions that were meant to expire but didn't.
Tuning parameters¶
- Duty granularity — defined at the level of system permissions or of business functions. Fine granularity separates precisely but can fragment a small team's work; coarse definitions are workable but can miss a specific toxic grant.
- Collusion assumption — whether the design resists a single bad actor or an N-party ring. Guarding against collusion demands more separated roles and cost.
- Exception strictness — the threshold that forces an exception, the compensating controls required, and the expiry. Strict exceptions are safer but slow a lean team; loose ones invite normalization.
- Monitoring cadence — how often access is re-attested for drift and re-merged duties. Frequent review catches creep early but is administratively heavy.
- Toxic-combination scope — how broad the catalog of incompatible pairs is. Broader coverage is safer but over-splitting cripples throughput in small units.
When it helps, and when it misleads¶
Its strength is that it prevents fraud and oversight failure by structure rather than by vigilance — a well-separated process is safe even when everyone is busy and no one is watching — and it keeps capable people employed by splitting their powers rather than excluding them from the process.
Its signature failure is hidden exception normalization: exceptions granted for genuine constraints accumulate, go unreviewed, and hollow the control until the separation is performative.[n1] Collusion also defeats a split designed only against a single actor, and over-fine separation can grind a small team to a halt, trading so much throughput for control that people invent workarounds that re-merge the duties informally. The classic misuse is a standing exception with no expiry and no compensating control — separation on paper, concentration in practice. The discipline that keeps it honest is to bound and expire every exception, attach real compensating controls, and monitor exception accumulation and access drift as first-class risks rather than paperwork.
How it implements the components¶
redesign_option— its primary control: it restructures who holds which power so the destructive authority combination cannot form on any single actor.exception_review_path— when duties cannot be fully split, it provides the accountable, time-limited, compensating-control-backed exception that permits the combination without normalizing it.residual_risk_monitoring— it watches for access drift, re-merged duties, and expired-but-live exceptions that would quietly rebuild the conflict after the initial design.
It works on authority assignments, so it does not enumerate and grade the full conflict field for display (antagonistic_combination_set, interaction_severity_rating — Conflict Matrix), interpose a physical or temporal separation (separation_boundary, sequencing_rule, buffer_or_shield — Material Incompatibility Rule and Schedule Conflict Prevention), or automatically detect a co-active clash (co_activation_detector — Dependency Conflict Detection). Its nearest twin is the Conflict Matrix, which likewise reasons about role, rule, and incentive conflicts — but the matrix only maps and grades them, whereas Separation-of-Duties Review restructures the assignments, runs the exception lifecycle, and monitors for drift.
Related¶
- Instantiates: Antagonism Screening and Separation — it is the archetype's governance control, breaking a destructive concentration of authority by design.
- Consumes: Conflict Matrix — the register of incompatible duty pairings supplies the toxic-authority set the review acts on.
- Sibling mechanisms: Conflict Matrix · Dependency Conflict Detection · Drug Interaction Screening · Material Incompatibility Rule · Schedule Conflict Prevention · Compatibility Matrix · Quarantine or Isolation Protocol · Conflict-of-Interest Check
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Separation Of Duties Review operates by evaluates actor-duty combinations for toxic authority conflicts and issues remediation findings. That concrete deployed or enacted form is Assessment, Review & Assurance under the frozen taxonomy.
Nearest alternative: Organization, Role & Governance — Although Organization, Role & Governance can support this mechanism, the frozen evidence makes its operative form the act that evaluates actor-duty combinations for toxic authority conflicts and issues remediation findings; the alternative is therefore secondary rather than defining.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Accounting & Auditing
Origin pattern: Convergent development
Present-day reach: Universal
Rationale: Reviewing incompatible powers so authorization, custody, execution, and oversight do not collapse into one actor is foundational internal control.
Related originating lineages:
- Economics & Finance — Economics, finance, and mechanism-design practice supplies a parallel or contributing lineage for the mechanism's defining operation: prevents one actor or role combination from holding powers that interfere destructively with accountability, oversight, or independent judgment.
- Engineering & Design — Engineering design, reliability, and systems-safety practice supplies a parallel or contributing lineage for the mechanism's defining operation: prevents one actor or role combination from holding powers that interfere destructively with accountability, oversight, or independent judgment.
- Law & Governance — Separation of powers and independent review constrain self-dealing and unchecked authority.
- Organizational & Management Science — Role design assigns creation, approval, execution, and verification to distinct accountable functions.
- Security Studies & Intelligence Analysis — Least privilege and two-person control reduce compromise by any single principal.
Review resolution: The blind reviewers agree that accounting_auditing is the primary origin and differ only on alternate origin disagreement, domain reach disagreement, encyclopedia synthesis disagreement. I preserve every independently explained alternate from both records rather than imposing a numeric cap. I retain convergent because the combined record shows independent disciplinary development. The broader reach of universal records portability separately from historical provenance, and encyclopedia_synthesis=true preserves the affirmative synthesis judgment where either reviewer identified one.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] Segregation (separation) of duties is a core internal-controls principle — no single person should control all phases of a transaction — and a named requirement in financial-controls regimes such as Sarbanes-Oxley. Its recognized weak point is management override and exception creep: controls designed on paper are only as strong as the review that keeps their exceptions bounded and their access assignments from drifting back together. ↩a ↩b