ERP Segregation of Duties Setup Guide

SoD Conflict Matrix Design

The SoD conflict matrix is the authoritative document defining which ERP function combinations are prohibited for a single user. A standard ERP SoD matrix covers 150-300 conflict rules across financial modules (AP, AR, GL, FA), procurement (purchasing, receiving, vendor management), inventory (receipts, adjustments, shipping), and master data maintenance. Each conflict rule defines the two incompatible functions, the risk description, and the risk level (High, Medium, Low).

Building the matrix requires collaboration between internal audit, business process owners, and IT security teams.

• Define High-risk SoD conflicts: vendor master create + AP payment approval, journal entry + GL posting, PO creation + goods receipt
• Define Medium-risk SoD conflicts: customer master create + credit memo approval, inventory adjustment + cycle count approval
• Map each conflict rule to specific ERP permissions (menu items, transaction codes, form access) for automated detection
• Align conflict definitions with ISACA COBIT DSS05 and COSO Principle 10 requirements for segregation of duties
• Obtain sign-off from internal audit and business process owners on the complete SoD matrix before system configuration

SoD Rule Configuration and Violation Detection

Once the conflict matrix is defined, SoD rules must be configured in the ERP system or a complementary GRC (Governance, Risk, Compliance) tool. Native ERP SoD capabilities vary widely: some platforms offer built-in SoD analysis, while others require third-party GRC tools (SAP GRC, Pathlock, Fastpath) for comprehensive detection. SoD analysis should run at two points: preventive (during user provisioning to block conflicting role assignments) and detective (periodic scans of existing access to identify accumulated violations from role changes over time).

• Configure preventive SoD checks in the access provisioning workflow blocking conflicting role assignments before activation
• Schedule weekly detective SoD scans across all active users generating violation reports with user, conflict rule, and assigned roles
• Map ERP-specific permissions (transaction codes, menu items, form access) to each side of every SoD conflict rule for accurate detection
• Implement real-time SoD checking during role assignment in the access request workflow providing immediate feedback to approvers
• Generate SoD violation trend reports monthly showing new violations, resolved violations, and persistent violations requiring attention

Compensating Controls and Exception Management

When business requirements make SoD separation impractical (small organizations, specialized roles), compensating controls must be implemented and documented to mitigate the risk. Common compensating controls include supervisory review of transactions, independent reconciliation, detailed audit logging with management review, and transaction amount thresholds requiring additional approval. Each SoD exception must be formally documented with the business justification, approved compensating controls, risk acceptance sign-off, and periodic reassessment schedule.

• Document each SoD exception with business justification, risk assessment, compensating controls, and risk acceptance approval
• Implement supervisory review controls: manager reviews and signs off on all transactions executed by users with SoD exceptions
• Configure enhanced audit logging for users with SoD exceptions capturing full transaction detail for independent review
• Require quarterly reassessment of all SoD exceptions verifying business justification remains valid and compensating controls are effective
• Maintain a centralized SoD exception register with ownership, approval history, and compensating control effectiveness evidence