# Segregation of Duties (SoD)

> Source: https://netray.co/glossary/segregation-of-duties
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Glossary

## Short answer

Segregation of duties is an internal control that splits a sensitive process across different people so no single user can both create and approve a transaction, such as entering a vendor and also releasing its payment.

## Aliases

- SoD
- separation of duties
- SoD conflict

## Category

compliance

## Full Definition

Segregation of duties (SoD) is a control principle that assigns the steps of a risky business process to different users. In an ERP it is enforced through roles and permissions: the person who maintains the vendor master should not also post vendor invoices and approve payment runs. Auditors test it under SOX, internal audit programs and many customer quality requirements.

SoD is expressed as conflict pairs or rules. Typical conflicts include: create purchase order and approve purchase order, maintain vendor bank details and run payments, post journal entries and approve journals, adjust inventory and perform cycle count approval, and maintain item cost and post receipts. Each rule says that two functions must not sit with the same user, or must be mitigated by a compensating control such as a second reviewer.

ERPs implement the building blocks differently. NetSuite uses roles with permission levels (View, Create, Edit, Full) and offers a separate SoD tooling in its governance products. Infor SyteLine uses user groups and authorization on forms and IDOs. SAP uses authorization objects and has GRC Access Control for conflict analysis. In every case the real risk is not a single role but the combination of roles one person accumulates over years.

Small manufacturers often cannot fully segregate because one person wears several hats. The accepted answer is a documented compensating control, for example a monthly owner review of vendor changes and payment exceptions, rather than pretending the conflict does not exist.

## Why It Matters

- It is a core test in SOX 404 and external audits, and a failed SoD finding is a common reason for a control deficiency report.
- It limits fraud and costly errors, such as duplicate or fictitious vendor payments and unapproved inventory write-offs.
- Role creep makes conflicts appear silently after reorganizations, so periodic review matters more than the initial design.
- AI agents that act inside the ERP inherit the permissions of their service account, so SoD must be applied to agents as well as people.

## In Practice

A 120-user manufacturer runs a quarterly SoD report. It finds 6 users who can both maintain vendors and release payments, all from a consolidated AP role created during a staff shortage. The fix is to split the role into vendor maintenance and payment release, and for the two-person AP team the owner signs a monthly vendor-change report as a compensating control. Cleanup takes a few days of role work, not a project.

## Faq

### What is an example of a segregation of duties conflict in an ERP?

**Answer:** A single user who can create a vendor, enter the vendor's invoice and release the payment run. That combination allows a fictitious vendor to be paid with no second person involved.

### Can a small company comply if one person must do several tasks?

**Answer:** Yes, with compensating controls. Document the conflict, then add a detective control such as an owner or controller reviewing vendor changes and payment exceptions every month.

### Is SoD the same as role-based access control?

**Answer:** No. Role-based access control is the mechanism that grants permissions. SoD is the rule about which permissions must not be combined, and it is tested across all the roles a user holds.

## Search terms

segregation of duties ERP, SoD conflicts, what is segregation of duties, SoD matrix, SOX segregation of duties, ERP internal controls, NetSuite segregation of duties, access conflict analysis

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json