Segregation of Duties (SoD), sometimes called separation of duties, is a foundational control that divides critical tasks and privileges among multiple people so that no single individual can both perpetrate and conceal an error or fraud. The classic example is ensuring the person who initiates a payment is not the same person who approves it.
SoD reduces the risk of fraud, mistakes, and abuse of access by design. Auditors look closely at it because conflicting combinations of access — so-called toxic combinations — are a common root cause of financial misstatement and security incidents. Identifying and remediating these conflicts is a recurring requirement in SOC 2, ISO 27001, and financial-controls regimes.
The practical difficulty is scale: as systems and roles multiply, manually spotting conflicting access grants becomes infeasible, so organisations need a systematic way to define SoD rules and detect violations continuously.
Comply automates this — see the access reviews page.