Segregation of Duties Review Checklist Template

What the Segregation of Duties Review Checklist Covers

1. 1
   Phase 1

   Phase 1: Scope & Approve the Rule Set

   5 tasks

   The scope answers on the first task decide whether Phase 7 and the SOX hand-off task in Phase 6 appear.

   • Define the review scope and period — systems, legal entities and processes in scope, and whether this is a scheduled cycle or a triggered re-run
   • Map the four duties to each in-scope process — which activities authorise, record, hold custody and reconcile in purchasing, payroll, revenue, treasury and IT change
   • Update the conflict matrix — add rules for new processes, roles and functions, and retire rules for anything decommissioned
   • Rate each rule by risk — what could go wrong, and whether it could lead to fraud or a material misstatement
   • Approve the rule set before any access is extracted — the process owners and the controller sign it, so results are not re-argued later
2. 2
   Phase 2

   Phase 2: Extract User & Role Access

   5 tasks

   • Extract user-to-role assignments from each in-scope system — dated, complete and taken from the system itself, not a spreadsheet copy
   • Extract role-to-permission detail — conflicts live in permissions and transaction codes, not in role names
   • Include non-human and privileged accounts — service accounts, integrations, bots, AI agents that can post, shared IDs and emergency access
   • Reconcile the user list to the HR roster — leavers, movers and contractors, and people who hold access in more than one system
   • Record how the extract was proven complete — the report used, its parameters, the row counts and who ran it
3. 3
   Phase 3

   Phase 3: Identify Conflicts

   6 tasks

   The last task appears only when the usage check finds conflicting access that was exercised.

   • Run the rule set against role design — a conflict built into a role affects everyone who holds it
   • Run the rule set against user assignments — conflicts created by combining roles that are safe on their own
   • Check for conflicts that span systems — for example, supplier master data in the ERP and payment release in the banking portal
   • Log every conflict in the conflict register — user, rule, systems, risk rating and a named owner
   • Check usage logs for conflicting access that was exercised — a conflict used in the period is a stronger finding than one that only exists
   • Review the transactions performed through exercised conflicts — self-approved entries, new suppliers paid quickly, unusual amounts or timing
4. 4
   Phase 4

   Phase 4: Validate With Owners

   4 tasks

   • Send each conflict to the user’s manager and the process owner — confirm whether the access is needed for the job as it is done today
   • Separate false positives from real conflicts — record the reason, such as a permission that is display-only in practice
   • Decide the outcome for each conflict — remove the access, redesign the role, or accept it only where removal would stop the work
   • Escalate conflicts with no owner response by the due date — to the controller or CFO, with the risk rating attached
5. 5
   Phase 5

   Phase 5: Remove or Mitigate

   5 tasks

   • Remove or change access through the normal access-change process — the ticket reference recorded against each conflict
   • Redesign roles that carry built-in conflicts — split the role, re-run the rules against the new design, then reassign
   • Document an alternative control for every accepted conflict — who performs it, how often, from which report, and what it would catch
   • Confirm the alternative control actually operated — evidence of each occurrence in the period, reviewed by someone other than the conflicted user
   • Set an expiry date on every accepted conflict — temporary cover access ends on a date, not when someone remembers to remove it
6. 6
   Phase 6

   Phase 6: Re-run, Sign Off & Schedule

   5 tasks

   The hand-off task appears only when the review supports a SOX 404 programme. Sign-off is assigned to someone whose own access was not in the review.

   • Re-run the analysis after remediation — confirm removed conflicts are gone and that no new ones appeared in the meantime
   • Summarise the results — conflicts found, removed, accepted with alternative controls, and still open
   • Hand unmitigated conflicts to the SOX deficiency evaluation — with the conflict, the exposure period and any transactions reviewed
   • Sign off the review — the controller or CFO approves the conflict register and the accepted conflicts
   • Set the next review date and the re-run triggers — an ERP change, a role redesign, a reorganisation, an acquisition or a change in finance headcount
7. 7
   Phase 7 — Small Teams Only

   Phase 7: Small-Team Alternative Controls

   6 tasks

   Shown only when the first task records that incompatible duties cannot be fully separated with current staff.

   • Draw a duty map by person — every duty each finance team member holds, on one page
   • Appoint an independent reviewer — a director, the owner or an outside accountant, with no access to cash, payments or the ledger
   • Give the reviewer direct access to bank activity — statements or read-only online banking, and review of each bank reconciliation
   • Route high-risk transactions to the reviewer for approval — new suppliers, bank detail changes, payment runs, payroll and manual journals
   • Review system change and audit logs monthly — entries made by the person who holds conflicting duties, with questions and answers recorded
   • Consider handing a whole function to an external party — for example outsourced payroll, which separates the duty without a new hire