Segregation of Duties: How to Design and Test a Conflict Matrix

Segregation of duties means no single person can both commit an error or fraud and conceal it. The control sounds simple and is routinely broken by system roles that accumulate over time. A conflict matrix turns the principle into a document that can be tested. This post shows how to build one, test it, and handle small teams where full segregation is not possible.

Why the control exists

The Securities Exchange Act requires issuers to maintain internal accounting controls that provide reasonable assurance that transactions are executed in accordance with management's authorization, that they are recorded so statements can be prepared under GAAP and asset accountability maintained, that access to assets is permitted only as management authorizes, and that recorded accountability for assets is compared with the existing assets at reasonable intervals. Segregation of duties is one way those four objectives are met in practice. The SEC's interpretive guidance for management lists segregation of duties among the characteristics a control can have, alongside reconciliations, review and approval authorizations, and safeguarding of assets.

NIST's Cybersecurity Framework 2.0 states the same idea for access: subcategory PR.AA-05 says access permissions, entitlements and authorizations are defined in a policy, managed, enforced and reviewed, and incorporate the principles of least privilege and separation of duties.

Step 1: Define the duty pairs

For each process, list the duties and mark the pairs that must not sit with one person.

Step 2: Map roles and permissions

Export from the application: each user, each role, each permission. Translate permissions into the duties above. Spreadsheet or analytics tools can compute, per user, which duties they hold and whether any conflicting pair appears. Include shared and generic accounts, and include super-users and administrators, who often hold everything.

Step 3: Test the matrix

• Population. Obtain the full user list from the system, not from the person who administers it, and agree the record count to a second source such as an independent query.
• Conflicts. Compute conflicts by user and by role. A conflict inside one role is a design defect. A conflict created by assigning two roles to one user is a provisioning defect.
• Usage. For each conflicted user, look for transactions in the period where the user performed both sides, such as creating a vendor and approving its first payment. The conflict is a deficiency in design. An actual use is an exception to investigate for error or fraud.
• Compensating controls. For each unresolved conflict, identify a control that mitigates it and test it. The SEC guidance says a compensating control has a mitigating effect only if it operates at a level of precision that would prevent or detect a misstatement that could be material. See /us/blog/compensating-controls-precision-and-when-they-reduce-deficiency-severity.

Worked example

A company with $75 million of revenue and eight people in finance runs an ERP. The matrix test of the user list finds:

The AP lead's six vendors are investigated: each is matched to a W-9, a business registration and a purchase order. Two lack purchase orders. The controller's entries are tested: 14 entries reviewed, all supported. The IT manager's log is an incomplete compensating control because the person with the conflict maintains the evidence, so the log's completeness cannot be relied upon.

The evaluation continues under the deficiency evaluation framework: for each conflict, ask whether there is a reasonable possibility the controls would fail to prevent or detect a misstatement and the magnitude of the possible misstatement. See /us/blog/control-deficiency-aggregation-memo-sec-guidance-and-written-conclusion.

Small teams

With fewer than six people in finance, full segregation is rarely achievable. Common mitigations:

• Owner or CFO review of bank statements and canceled payments directly from the bank, not from a report the bookkeeper prepared.
• Owner approval of every new vendor and every change to vendor bank details.
• Outsourced or independent preparation of bank reconciliations.
• Monthly review of a log of entries by user, with attention to unusual posters and posting times.
• Rotation of duties and mandatory leave.

Document the rationale. The SEC guidance for smaller companies notes that management's daily interaction with controls can provide evidence in centralized operations with limited personnel, but not where there are multiple management layers or segments. So an owner-reviewed control can be adequate in a ten-person company and insufficient in a company with several segments.

Maintaining the matrix

Rerun after every role change and at least quarterly, and tie to the access review. See /us/blog/user-access-provisioning-and-quarterly-access-review-itgc-testing. Related glossary: /us/glossary/segregation-of-duties.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• Securities Exchange Act of 1934, section 13(b)(2)(B), 15 U.S.C. 78m(b)(2)(B): https://www.law.cornell.edu/uscode/text/15/78m
• SEC, Release No. 33-8810, Section II.A.1.b (footnote 27), Section II.A.2.b (smaller companies) and Section II.B.1 (compensating controls): https://www.sec.gov/rules/interp/2007/33-8810.pdf
• NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024), subcategory PR.AA-05: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error