Segregation of Duties (SoD)
The principle that no single individual should control all phases of a critical process. By dividing responsibilities, organizations reduce the risk of error, fraud, and unauthorized actions.
Why it matters
When one person can both approve and execute a transaction, or both develop and deploy code to production, you have a single point of failure and a single point of abuse. Segregation of duties is a foundational internal control that auditors check in every engagement. It applies to financial processes, IT operations, access management, and change control. Without it, your control environment has a structural weakness that no amount of monitoring can fully compensate for.
In practice
Implementing SoD means mapping critical processes, identifying conflicting roles, and ensuring no individual holds both sides of a sensitive operation. Common examples: separate individuals for approving and processing payments, different teams for developing and deploying code, distinct roles for granting and reviewing access rights. In vucavoid, controls can be assigned to different owners, and effectiveness reports require sign-off from someone other than the control operator, embedding SoD into your compliance workflow.