A segregation of duties (SoD) review finds those conflicts before an auditor or a fraud does. This free SoD review checklist is for controllers, internal audit, SOX teams and the IT staff who administer ERP access. It updates the conflict matrix, extracts access from each system, confirms conflicts with their owners, then removes each one or covers it with a documented alternative control. A conditional phase handles finance teams too small to separate every duty. The output is a signed conflict register in which every conflict has an outcome, an owner and evidence.
The PCAOB’s staff guidance for auditors of smaller public companies names the four duties that should sit with different people: authorising transactions, recording them, reconciling information and keeping custody of assets. One person holding two of them can make an error or a theft and then hide it: a clerk who can create a supplier and release payments to it, or a developer who can change code and deploy it.
COSO’s 2013 Internal Control – Integrated Framework places segregation of duties under Principle 10, the principle on selecting and developing control activities. Its point of focus reads, in short: segregate incompatible duties, and where that is not practical, select and develop alternative control activities. The review has to prove both halves, and the wording matters because auditors use two different terms.
Source: COSO Principle 10; the note to AS 2201.42 on smaller companies.
When: management knows a person holds conflicting duties and designs a control that meets the same objective.
Auditor’s view: evaluates whether the alternative control is effective.
Source: AS 2201.68, on evaluating deficiencies.
When: an unplanned conflict is found and another control is put forward to limit its severity.
Test: it must operate at a level of precision that would prevent or detect a misstatement that could be material.
Auditor’s view: weighs it in judging whether there is a material weakness.
Scoping, risk assessment and the 302 and 404 reporting cycle belong to the SOX 404 Compliance Checklist. Testing controls, including the alternative controls recorded here, belongs to the SOX Internal Control Testing Checklist. A general user access review asks whether each account is still needed; this review asks whether the combination of access is safe.
Six phases take the review from rule set to sign-off. A seventh appears only when the team is too small to separate every duty.
The scope answers on the first task decide whether Phase 7 and the SOX hand-off task in Phase 6 appear.
The last task appears only when the usage check finds conflicting access that was exercised.
The hand-off task appears only when the review supports a SOX 404 programme. Sign-off is assigned to someone whose own access was not in the review.
Shown only when the first task records that incompatible duties cannot be fully separated with current staff.
Sarbanes-Oxley itself never uses the phrase. The expectation comes from the control framework management assesses against, such as COSO, and from auditing standards. The table maps each source to the part of the review that produces evidence for it. Your obligations depend on your reporting regime and your auditor, so treat the table as a starting point, not legal advice.
| Source | What it says about segregation of duties | Evidenced in |
|---|---|---|
| COSO 2013, Principle 10 | Point of focus “Addresses Segregation of Duties”: segregate incompatible duties, or develop alternative control activities where that is not practical | Phases 1, 3 and 5 |
| COSO 2013, Principles 3 and 11 | Authorities and responsibilities are defined and limited; technology access rights are restricted to authorised users in line with their job responsibilities | Phases 1, 2 and 4 |
| PCAOB AS 2201.42 (note) | A smaller company with fewer accounting staff may use alternative controls; the auditor evaluates whether they are effective | Phases 5 and 7 |
| PCAOB AS 2201.68 | A compensating control counts only if it operates at a precision that would prevent or detect a potentially material misstatement | Phases 5 and 6 |
| SOC 2: CC5.1, CC6.3, CC8.1 | CC5.1 carries COSO Principle 10 and its SoD point of focus; CC6.3 grants access considering least privilege and segregation of duties; a CC8.1 point of focus deploys changes with segregation of responsibilities | Phases 2–5 |
| GAO Green Book (2025 revision), 10.21–10.23 and 11.16 | Separate authority, custody and accounting; design alternative controls where limited personnel prevent it; separate critical IT responsibilities | Phases 1, 5 and 7 |
| ISO/IEC 27001:2022, Annex A 5.3 | Conflicting duties and conflicting areas of responsibility are segregated | Phases 1 and 3 |
The Green Book’s 2025 revision applies to US federal entities from fiscal year 2026. In February 2026 COSO published guidance on internal control over generative AI that applies the 2013 framework rather than replacing it. Its taxonomy includes a posting capability, a good reason to treat any AI agent that can post or approve as a user in Phase 2.
Keep the conflict matrix as a data set and the register as a table inside the Phase 3 task. Access extracts and change tickets are attached to the conflict they resolve, not stored in a folder nobody links back.
Validation tasks go to the managers who own the access. Accepted conflicts go through an approval step with an expiry date, and the activity trail records who approved what and when. Enforced step order means sign-off cannot happen before the re-run.
A recurring schedule opens the review on your chosen cycle, and the Phase 5 alternative controls run on their own monthly checklists. Template versioning ties each review to the rule set it used.
CheckFlow is not an identity governance platform, a GRC tool or an SoD analysis engine. It does not calculate conflicts inside your ERP; you attach the extract or push it in through the REST API, webhooks or Zapier. CheckFlow runs the human part: validation, decisions, approvals and evidence. CheckFlow for SOC 2 teams shows how the same pattern covers the access and change controls a service auditor samples.
For listed companies, the conflict register feeds the wider SOX 404 Compliance Checklist, and the alternative controls it records are tested in the SOX Internal Control Testing Checklist. The Purchase Order Approval Checklist is a working example of separating requester, approver and buyer in a single process.
It is a periodic check that no one person holds a combination of access that would let them commit and conceal an error or fraud. You compare each user’s actual access against conflict rules, confirm the results with the access owners, then remove each conflict or cover it with a documented control, ending with a signed register.
Authorisation, recording, custody of assets, and reconciliation or verification. The PCAOB’s staff guidance for smaller public companies describes assigning these to different people, and ISACA and state auditors use the same model. So the person who approves a purchase should not also create the supplier, receive the goods or reconcile the supplier account.
None of the frameworks above fixes a frequency, so set one from risk and record why. The Washington State Auditor’s guide, updated in March 2026, suggests reviewing system access at least annually, and more often after staffing changes or in a new system’s first year. Where the review supports SOX or SOC 2, consider a shorter cycle for the ERP and payment systems. Re-run it after any of the triggers in Phase 6.
An alternative control is designed in advance because separating the duties is not practical: COSO Principle 10 and the note to AS 2201.42 use that term. A compensating control is one put forward after a deficiency has been found, to argue the deficiency is less severe. The PCAOB staff guidance draws exactly this distinction. Under AS 2201.68 a compensating control only helps if it would catch a misstatement that could be material, so a high-level monthly review of totals is unlikely to qualify.
Bring in oversight from someone who does not handle the money. The Washington State Auditor’s guide suggests a governing-body member, an outside accountant or a swap of review duties with a neighbouring organisation. The PCAOB staff guidance adds outsourcing a whole function and management review of transactions, reconciliations and asset counts. Phase 7 of this template sets these up.
Not automatically: a conflict with an effective alternative control may not be a deficiency at all. An unmitigated conflict is evaluated like any other control deficiency: its severity depends on whether there is a reasonable possibility that it could lead to a misstatement, and how large that misstatement could be. The PCAOB staff guidance warns that a pervasive lack of segregation without alternative controls can make the design of other controls ineffective.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
