Lesson 24.2: Segregation of Duties

Where This Lesson Fits

Lesson 24.1 established the internal control principles and the COSO framework that govern control design throughout the unit. It identified preventive controls as the first and most efficient line of defense, and described management override as the most significant limitation of preventive controls. Segregation of duties (SOD) is the foundational preventive control structure that addresses both of these points: it is the most widely applied preventive control in operations environments, and it is the primary means by which organizations limit the ability of any single individual — including management — to unilaterally execute transactions without a check from another person.

This lesson examines segregation of duties as a control mechanism in full operational detail: what functions must be separated and why, how SOD is implemented in system and organizational structures, where SOD requirements create practical challenges in small or understaffed environments, and what compensating controls are appropriate when true SOD cannot be maintained. It also establishes the conceptual foundation for Lesson 24.3, which examines dual authorization — a specific implementation of SOD principles applied to the approval function for high-risk transactions.

Lesson Objective

By the end of this lesson, students should be able to define segregation of duties and explain the three primary functional categories that must be separated in an effective SOD framework; identify the four key transaction functions — initiation, authorization, execution, and recording — and explain why concentrating more than one of these in a single individual or role creates control risk; describe how SOD is implemented in system configurations, organizational structures, and policy frameworks; identify the specific conflict combinations that regulators and audit standards consider incompatible; explain the concept of SOD conflict and describe how incompatible duty combinations create both error risk and fraud risk; describe compensating controls appropriate when full SOD cannot be maintained; and evaluate the SOD adequacy of a described operational scenario.

Lesson Overview

Segregation of duties is the organizational and procedural control that prevents any single individual from having the ability to both execute a transaction and conceal it, or to both initiate an error and approve it without independent review. The core logic is straightforward: errors are less likely to survive review when the reviewer is independent of the person who made the error; fraudulent transactions are harder to execute and conceal when each step in the transaction requires a different person. By distributing the functions involved in any transaction across multiple individuals, SOD ensures that any error or misconduct would require either the cooperation of multiple people (collusion) or detection by an independent reviewer.

The four primary transaction functions that segregation of duties addresses are: initiation (submitting or requesting a transaction), authorization (approving the transaction for processing), execution (actually performing the transaction, such as releasing a wire or posting a trade), and recording (creating the accounting or system record of the transaction). When these four functions are distributed across different people, no single person can complete a transaction cycle without at least one other person having an opportunity to review it. When any two or more of these functions are concentrated in a single person, a conflict exists — either because errors may not be caught before execution, or because misconduct can be self-approved and self-concealed.

In wealth and asset operations, the practical challenge is that many small and mid-sized firms do not have the staffing to fully segregate all functions across all processes. This lesson addresses how to prioritize SOD investments where the risk is highest, how to design compensating controls for processes where full SOD is not achievable, and how to document SOD gaps and the compensating controls in place to address them for regulatory and audit purposes.

Why This Matters in Wealth & Asset Operations

SOD failures are the most consistently identified control deficiency in regulatory examinations of wealth management and investment adviser operations. The SEC's examination priorities documents and FINRA examination findings published annually cite inadequate segregation of duties as a leading deficiency year after year. The reason is structural: wealth management operations often involve small teams, where individual staff members may have broad system access and broad operational responsibility. The efficiency pressures of lean staffing push organizations toward concentrating functions; the risk management imperative pushes in exactly the opposite direction.

The consequences of SOD failures in wealth management are severe because the assets involved are client assets. When a single individual controls initiation, approval, and execution of wire transfers, the opportunity for misappropriation exists regardless of whether that individual is trustworthy today. Fraud schemes in wealth management operations — including some of the most consequential employee fraud cases in the industry — have been enabled by SOD failures that gave a single employee the ability to move client funds without any independent review. SOD is not primarily a safeguard against the current staff; it is a structural control that limits the opportunity for misconduct regardless of who occupies a given role.

Core Concept

Segregation of Duties (SOD) — The organizational and procedural practice of distributing the key functions within a transaction process across multiple individuals so that no single person has the ability to both execute and conceal an error or fraud. SOD is the foundational preventive control in financial operations and is required by virtually every regulatory framework applicable to wealth management.

Incompatible Duties — Two or more functions that, if performed by the same individual, create a control conflict because the person could either commit an error or fraud without independent review, or could both initiate and conceal misconduct. The most fundamental incompatible duty combinations in wealth operations are: initiating a transaction and approving it; approving a transaction and executing it; executing a transaction and recording it; and custody of assets and accounting for those assets.

SOD Conflict — The condition that exists when two or more incompatible duties are assigned to or accessible by the same individual. SOD conflicts are identified through access control reviews (which roles and system permissions does an individual hold) and organizational structure analysis (which functional responsibilities does an individual's job description include). Identified conflicts must either be resolved by redistributing duties or mitigated by compensating controls.

Compensating Control — A control implemented to mitigate the risk created by an SOD conflict when full segregation cannot be achieved. The most common compensating control is enhanced supervisory review: an independent manager reviews completed transactions or a statistical sample of transactions at a frequency and level of detail sufficient to detect any error or misconduct that the SOD conflict would otherwise allow to go undetected. Compensating controls must be formally documented and must be demonstrably effective at addressing the specific risk created by the conflict.

Collusion Risk — The residual risk that remains in an SOD-segregated environment because multiple individuals could cooperate to circumvent the controls. SOD eliminates the ability of a single person to commit fraud undetected; it does not eliminate the ability of multiple people to cooperate in committing fraud. Collusion risk is reduced by rotating staff across roles, maintaining independent monitoring, and creating an organizational culture in which collusion is unlikely to remain undiscovered.

The Four Transaction Functions and Their Separation

Every financial transaction in wealth operations can be decomposed into four functional steps. The SOD requirement is that, for any high-risk transaction type, these four functions must be distributed across different individuals so that no single person controls more than one step without independent oversight of the others.

• Initiation — The act of submitting or requesting a transaction. In a wire transfer context, initiation is the step at which an operations staff member enters the wire instruction into the processing system, specifying the account, amount, beneficiary, and other required fields. Initiation creates the transaction record. The initiator should not have the ability to approve, execute, or record the transaction. In properly configured systems, the initiating staff member submits the transaction to a queue; it does not release to the custodian until an independent approver acts on it.
• Authorization — The act of approving a submitted transaction for execution, typically after reviewing it for compliance with applicable policies and verifying that supporting documentation is in order. The authorizer should be independent of the initiator and should have no incentive to approve transactions that benefit the initiator. In wealth operations, authorization is the function addressed by dual authorization requirements (Lesson 24.3) and approval workflow controls (Lesson 24.5).
• Execution — The act of completing the transaction — releasing a wire to the custodian, settling a trade, posting a deposit. In automated systems, execution may occur automatically upon authorization. In manual or semi-automated processes, execution may require a separate system action by a third individual. The executor should not be the same person as the initiator or the authorizer.
• Recording — The act of creating or updating the accounting or system record of the completed transaction — posting the debit and credit entries, updating the position record, generating the confirmation. The recorder should be independent of all prior functions so that the transaction record cannot be manipulated to conceal an error or misappropriation. In modern wealth management systems, recording is often automated by the transaction system itself, which reduces but does not eliminate the risk of record manipulation.

The most critical SOD requirement is the separation of custody from recording: the person who has physical or electronic custody of assets should never also be responsible for recording transactions affecting those assets. This is the SOD principle that most directly prevents embezzlement and misappropriation.

SOD Implementation: Systems, Roles, and Organizational Structure

Segregation of duties is implemented through three complementary mechanisms: system access controls, role definitions and job descriptions, and organizational reporting structures. Effective SOD requires all three to work together; any single mechanism alone is insufficient.

• System Access Controls — The most reliable implementation of SOD is system-enforced separation: the transaction processing system simply does not allow the same user account to both initiate and approve a transaction. This is implemented through role-based access control (RBAC), in which each user is assigned system roles that grant specific permissions, and incompatible permission combinations cannot coexist in a single user account. For example, an "initiator" role may have permission to create and submit wire requests but not to approve them; an "approver" role may have permission to review and release pending wires but not to create new ones. System-enforced SOD is more reliable than policy-only SOD because it cannot be bypassed without an IT system configuration change, which itself creates an audit trail.
• Role Definitions and Job Descriptions — Even where system enforcement is in place, SOD must also be reflected in formal role definitions and job descriptions that describe which functional responsibilities each role carries and explicitly identify which responsibilities are incompatible with each role. Role definitions are used by HR and management in structuring positions and assigning duties; they are reviewed by compliance and internal audit to identify conflicts; and they are provided to regulators as documentation of the SOD framework. A job description that lists incompatible duties — even if the system technically prevents their combined execution — creates a documentation gap that raises examination concerns.
• Organizational Reporting Structure — SOD requires not only that different individuals perform different functions but that those individuals report through different management chains where possible. If the initiator and approver of a high-risk transaction type both report to the same supervisor, and that supervisor can pressure both to act in concert, the organizational structure undermines the SOD intent. In well-designed organizations, the authorization function for high-risk transactions is assigned to a management level or function that is independent of the operations team that initiates transactions.
• SOD Matrix — In practice, large operations teams document their SOD requirements and conflicts in an SOD matrix: a structured table that lists all transaction types in one dimension, all system roles and organizational roles in the other, and identifies for each combination whether the role is permitted to perform that function, whether a conflict exists, and what the compensating control is for any documented conflict. The SOD matrix is maintained by the risk or compliance function and reviewed annually (or when roles change) to verify that documented conflicts are still being adequately mitigated.

SOD in Large vs. Small Operations Environments

The practical application of SOD requirements differs significantly between large and small wealth management operations. Understanding these differences is important because most exam scenarios and regulatory findings arise in contexts where the right SOD structure is known but achieving it is organizationally difficult.

In large operations teams with five or more staff, full SOD across all four transaction functions for all high-risk process types is generally achievable. Different staff members can be assigned to initiation, authorization, and execution roles, with the system configured to enforce the separation. Rotation across roles can be implemented to build operational cross-training while periodically changing the individual with access to each function.

In small operations teams with two to four staff — common in independent RIAs and smaller broker-dealers — full four-function separation is often structurally impossible. With two operations staff, at minimum two of the four functions must be held by the same person. The regulatory and audit guidance for this scenario does not waive SOD requirements; it requires that the firm: (1) document the specific SOD conflicts that exist, (2) identify the risk each conflict creates, (3) implement a formally documented compensating control for each conflict, and (4) subject the compensating controls to independent monitoring. The most common compensating control in small operations environments is enhanced supervisory review by the principal or owner, reviewing 100% of transactions above a threshold for evidence that each was properly authorized and documented.

One-person operations teams present the most significant SOD challenge: there is no second person to perform any function independently. Firms in this situation typically address it through: outsourcing specific control functions to an independent third party (a third-party administrator or custodian that performs independent reconciliation); requiring client confirmation for all transactions above a threshold; or engaging an outside compliance consultant to perform periodic independent reviews. Regulators recognize that one-person operations cannot achieve traditional SOD, but they still expect meaningful compensating controls with independent oversight — the fact that SOD is not achievable does not eliminate the underlying risk.

Operational Workflow: Wire Transfer Processing with Full SOD

The following describes the complete workflow for outbound wire transfer processing in an operations environment with full segregation of duties implemented and system-enforced. This workflow is the standard against which actual environments are evaluated in SOD assessments.

1. Client Instruction Receipt. A wire instruction is received from the client through an authorized channel — signed written instruction, authenticated portal submission, or verbal instruction confirmed in writing per the firm's verbal instruction policy. The instruction is logged in the instruction intake system with a timestamp and the identity of the receiving staff member. The intake staff member has no wire processing system access — they are a first-stage receiver only.
2. Instruction Entry and Initiation. An operations staff member with initiator access enters the wire instruction into the wire processing system, mapping all fields (account number, amount, beneficiary name, beneficiary account and routing, memo) from the client instruction. The system validates required fields and confirms that the beneficiary account is registered in the client's profile (for pre-authorized beneficiaries) or flags it as a new beneficiary requiring additional verification. The initiator submits the wire to a pending approval queue. The wire is not released to the custodian at this stage. The initiator does not have approver or execution access.
3. Independent Verification. For wire transfers above the firm's threshold (typically $25,000 to $50,000, though thresholds vary by firm), the approver performs independent verification before approval: confirms the instruction against the original client instruction document, verifies the beneficiary details against client records, and — for high-value wires or wires to new beneficiaries — may call back the client at a number on file to confirm the instruction is genuine. This callback step is a preventive control against social engineering fraud that replaces SOD in the specific fraud scenario where a legitimate client instruction has been intercepted and modified.
4. Authorization. The approver, having completed independent verification, logs into the wire processing system with their unique approver credentials and approves the pending wire. The system records the approver's identity and timestamp alongside the initiator's identity and timestamp. The wire moves from the pending approval queue to the execution queue. The approver does not have initiator access and cannot modify the wire fields after submission.
5. Execution. In automated systems, execution to the custodian occurs automatically upon approval during business hours. In manual systems, a third staff member with execution access releases the wire to the custodian. In either case, the execution event is logged with a timestamp. The custodian's acknowledgment of receipt is recorded in the system.
6. Recording. The transaction is posted to the client's account by the portfolio accounting system, which receives the completed wire data from the wire processing system. In automated environments, this posting is system-generated without manual intervention, producing an immutable record. The posting is queued for daily reconciliation.
7. Reconciliation. At the close of business, all wire transactions posted in the portfolio accounting system are reconciled against the custodian's wire activity records. Discrepancies are escalated to the operations supervisor. The reconciliation is performed by a staff member who did not initiate, approve, or execute any of the wires being reconciled — preserving the independence of the recording and verification step.

Real-World Example

A registered investment adviser employs three operations staff: a senior operations specialist (Staff A), a junior operations specialist (Staff B), and an operations manager (Staff C). The firm processes client wire requests daily. The documented SOD structure is: Staff A and B initiate wires; Staff C approves wires above $10,000; all wires release automatically to the custodian upon approval; reconciliation is performed by Staff B each morning for the prior day's activity.

During an internal audit review, the auditor discovers that Staff C — the approver — also has initiator access to the wire processing system, which was granted when the firm hired Staff A and B and the system was not reconfigured to remove Staff C's prior initiator permissions. The auditor also discovers that on 14 occasions in the prior quarter, Staff C had both initiated and approved wires — wires that Staff A and B were not involved with at all. Review of the 14 wires shows they were all legitimate client transactions, but the SOD failure was complete: the same individual both submitted and approved all 14 wires with no independent review.

The auditor issues a finding of a material SOD conflict: Staff C holds both initiator and approver access, and has actively used both, creating a scenario in which Staff C could initiate and approve fraudulent wires without any independent check. The firm's remediation plan: immediately remove initiator access from Staff C's system account; configure the system to prevent any user from holding both initiator and approver roles simultaneously; implement a monthly review by the principal of all wire transactions processed in the prior month to serve as a compensating control while the system reconfiguration is validated; and add the SOD matrix to the annual SOD review agenda to prevent recurrence.

Common Mistakes

Mistake 1: Relying on Policy Rather Than System Enforcement for SOD

A policy that says "no staff member shall both initiate and approve a wire transaction" does not enforce itself. Policy-only SOD is one step above no control: it sets an expectation but relies entirely on individual compliance, and creates no systemic obstacle to circumvention. When the operations manager is in a hurry and the approver is unavailable, a policy is easily ignored. System-enforced SOD — where the transaction processing system physically cannot be used by the same individual in both the initiator and approver role — is categorically more reliable than policy-only SOD.

Mistake 2: Granting Residual Permissions That Create Unintended SOD Conflicts

SOD conflicts are frequently created not by deliberate organizational choices but by access provisioning errors: a staff member is promoted to a new role, their new access is granted, but their old access is not removed. Over time, as staff are promoted, transferred, and temporarily reassigned, they accumulate permissions that span incompatible functions. Operations teams that do not perform periodic access reviews — at least annually — accumulate these residual permissions to the point where documented SOD structures bear no resemblance to the actual access map of the organization.

Mistake 3: Treating Compensating Controls as Equivalent to SOD

Compensating controls mitigate the risk created by SOD conflicts; they do not eliminate the underlying conflict or replace the value of true SOD. A firm that accepts SOD conflicts across all high-risk processes on the grounds that management review is a compensating control for all of them has effectively implemented a management-review-only control environment — with all the vulnerabilities that creates, including management override and the failure modes of periodic rather than transaction-by-transaction review. Compensating controls are appropriate for situations where SOD is genuinely impractical; they are not an acceptable substitute for SOD where SOD is achievable.

Mistake 4: Not Documenting SOD Conflicts and Compensating Controls for Examination

When a regulatory examination identifies an SOD conflict, the examiner's first question is whether the firm knows about the conflict and what it has done about it. A firm that is unaware of its own SOD conflicts and has no compensating controls receives a more serious finding than a firm that has identified the conflict, documented it in its SOD matrix, implemented a named compensating control, and can demonstrate that the compensating control is being actively performed. Documenting known conflicts and their compensating controls is not an admission of weakness — it is evidence of a functioning risk management process.

Mistake 5: Failing to Address SOD When Staff or Systems Change

SOD is not a one-time configuration. Any time a staff member changes roles, any time a system is upgraded or replaced, and any time a new transaction type or product is added, the SOD configuration must be reviewed and updated. Firms that perform a thorough SOD design at implementation and then never revisit it develop growing control gaps as the organization changes around the original design. SOD review must be a standing agenda item in annual control assessments, triggered additionally by any significant organizational or system change.

Practical Exercises

Exercise 1: Incompatible Duty Identification

For each of the following role descriptions, identify whether the described responsibilities include incompatible duties, specify which combination is incompatible, and describe the specific risk the incompatibility creates: (a) The operations associate enters all cash movement requests into the processing system and also performs the daily reconciliation of cash movements against the custodian records. (b) The compliance officer approves all new account applications and also reviews the firm's AML procedures for adequacy. (c) The portfolio accounting staff member posts all corporate action entitlements to client accounts and also reviews the custodian's corporate action records for accuracy. (d) The senior operations specialist can both initiate wire transfers and approve them when the operations manager is out of the office. (e) The client service representative receives verbal wire instructions from clients, enters them into the request intake system, and notifies operations to process them. Identify which scenarios contain SOD conflicts and which do not, and explain your reasoning for each.

Exercise 2: SOD Matrix Construction

A three-person operations team at a registered investment adviser consists of: Operations Specialist (OS), Senior Operations Specialist (SOS), and Operations Manager (OM). The firm's key transaction types are: wire transfers, account transfers (ACAT), and corporate action elections. For each transaction type, the four functions are: initiate, authorize, execute, and record. Design an SOD matrix for this team that assigns each function for each transaction type to one or more roles while maintaining the maximum practical segregation. Identify any conflicts that remain due to staffing constraints, specify the compensating control you would implement for each, and explain why the compensating control is appropriate for the specific risk the conflict creates.

Exercise 3: Access Review Scenario

A semi-annual access review of a wealth management firm's wire processing system reveals the following: (a) Staff Member 1 holds both initiator and approver roles in the system. She was the approver before the firm hired two new operations staff, and her approver access was not removed when her role changed to initiator-only. (b) Staff Member 2 holds both recorder and execution roles. He was the sole operations staff member 18 months ago, and his system access was never reduced when additional staff were hired. (c) Staff Member 3 holds initiator access only. Her access is consistent with her current role. (d) The Operations Manager holds approver access only. This is consistent with his current role and has not changed since hiring. For Staff Members 1 and 2, describe the specific SOD conflicts that exist, the risk each creates, the recommended remediation, and the compensating control that should be in place until the remediation is complete.

Exercise 4: Small Firm SOD Design

A two-person investment adviser processes approximately 40 wire transfers per month, ranging from $5,000 to $2 million. The firm has one principal and one operations staff member. Design the most robust SOD framework possible for this firm given the staffing constraint, addressing: which functions are performed by which person; what compensating controls substitute for the SOD that cannot be achieved; what role the custodian can play in compensating for the internal SOD gap; what documentation the firm should maintain to demonstrate to an examiner that it has addressed the SOD limitation; and how the framework should be adjusted for wires above $500,000.

Key Terms

Segregation of Duties (SOD) — The organizational and procedural control that distributes initiation, authorization, execution, and recording functions across multiple individuals to prevent any single person from having the ability to both execute and conceal an error or misconduct.

Incompatible Duties — Two or more transaction functions that, if performed by the same individual, create a control conflict because the person could execute errors or fraud without independent review.

SOD Conflict — The condition that exists when an individual holds responsibilities or system access for two or more incompatible functions. Conflicts must be resolved or mitigated by compensating controls.

SOD Matrix — A structured documentation tool that maps transaction types against organizational and system roles, identifying which functions are assigned to which roles, where conflicts exist, and what compensating controls are in place for each conflict.

Compensating Control — A control implemented to mitigate the risk created by an SOD conflict when full segregation is not achievable. Most commonly, an enhanced independent supervisory review of transactions processed under the conflicted combination.

Role-Based Access Control (RBAC) — A system access management approach in which permissions are assigned to roles rather than individuals, and users are assigned to roles. Enables system-enforced SOD by configuring roles so that incompatible permission sets cannot coexist in a single user account.

Collusion Risk — The residual risk in an SOD environment that multiple individuals could cooperate to circumvent controls. Reduced by role rotation, independent monitoring, and organizational culture.

Initiation — The transaction function of submitting or requesting a transaction. In wire transfer processing, the function of entering wire instruction fields and submitting to the approval queue.

Authorization — The transaction function of approving a submitted transaction for execution after independent review of its completeness, accuracy, and compliance with applicable policies.

Execution — The transaction function of completing the transaction — releasing a wire, settling a trade, posting a deposit.

Recording — The transaction function of creating or updating the accounting or system record of a completed transaction. Must be independent of all prior functions to prevent record manipulation.

Access Review — A periodic process (typically annual or semi-annual) that reviews all system access permissions against current role assignments, identifies residual permissions from prior roles, and removes or modifies access to restore the intended SOD configuration.

Knowledge Check

Question 1

Which of the following combinations of functions held by a single individual represents the most critical SOD conflict in wealth management operations?

• A. Initiating wire transfers and performing daily reconciliation
• B. Approving wire transfers and reviewing client account statements
• C. Initiating wire transfers and approving them
• D. Recording transactions and reviewing exception reports

Correct Answer: C — A single individual who can both initiate and approve wire transfers can create and approve fraudulent or erroneous wires without any independent review. This combination eliminates the independent check that is the entire purpose of the authorization function and represents the most direct path to misappropriation of client funds.

Question 2

A two-person wealth management firm cannot achieve full segregation of the four wire transfer functions because only two individuals are available. What is the most appropriate response to this constraint?

• A. Accept the SOD gaps as unavoidable and implement no additional controls
• B. Document the specific SOD conflicts, identify the risk each creates, implement compensating controls (such as 100% supervisory review or custodian-level controls), and document these compensating controls for examination purposes
• C. Process wires only monthly to reduce the frequency of the control gap
• D. Require clients to submit wire instructions directly to the custodian to eliminate the firm's operational role

Correct Answer: B — The appropriate response to an unavoidable SOD gap is: acknowledge it formally, document it in the SOD matrix, implement compensating controls that address the specific risk, and document those controls for examiner review. Regulators understand that small firms face structural staffing limits; what they look for is that the firm has identified the gap and implemented meaningful mitigation.

Question 3

System-enforced SOD (preventing the same user from holding incompatible system roles) is preferable to policy-only SOD primarily because:

• A. System configuration is less expensive than written policies
• B. System enforcement cannot be bypassed without an IT change that creates an audit trail, while policy-only SOD relies entirely on individual compliance and is easily circumvented under pressure
• C. System-enforced SOD eliminates collusion risk
• D. Policy-only SOD does not satisfy regulatory requirements in any circumstance

Correct Answer: B — System-enforced SOD is a preventive control that creates a structural barrier to circumvention; policy-only SOD is a behavioral expectation that has no structural enforcement. Under operational pressure, policy-only controls are frequently bypassed because there is no system obstacle to doing so. System enforcement also creates an audit trail of any changes to the access configuration, making changes visible to monitoring functions.

Question 4

During an annual access review, an operations manager discovers that a staff member who was promoted six months ago still holds both initiator and approver access in the wire processing system, even though her current role is approver-only. What should the operations manager do?

• A. Review the wire transactions she processed in the last six months, remove her initiator access immediately, and implement a compensating review of all wires she both initiated and approved during the period
• B. Remove her initiator access and take no further action, since all her transactions were likely legitimate
• C. Document the access anomaly and address it at the next scheduled access review
• D. Leave the access in place since she has not been observed misusing it

Correct Answer: A — The correct response is: immediate remediation (remove the incompatible access), retroactive review of the period during which the conflict existed (to identify any transactions that were both initiated and approved by the same person and confirm they were legitimate), and documentation of both the finding and the remediation. Deferring action or taking no retroactive review leaves the organization unable to demonstrate that the conflict was not exploited.

Question 5

What is the primary residual risk that remains in a properly designed SOD environment where all four transaction functions are segregated across different individuals?

• A. No residual risk remains once full SOD is implemented
• B. Collusion risk — the possibility that multiple individuals cooperate to circumvent the controls
• C. System configuration errors that grant incompatible access automatically
• D. Regulatory risk from examinations that may disagree with the SOD design

Correct Answer: B — SOD eliminates the ability of a single individual to both execute and conceal misconduct, but it does not eliminate the ability of multiple individuals to cooperate in doing so. Collusion risk is reduced by organizational design (separating reporting lines), role rotation, and monitoring, but it cannot be eliminated entirely. This is why controls beyond SOD — independent monitoring, reconciliation, and audit — are also necessary.

Lesson Summary

Segregation of duties is the foundational preventive control in financial operations — the structural mechanism that prevents any single individual from having the ability to both execute and conceal an error or misconduct. SOD works by distributing the four key transaction functions — initiation, authorization, execution, and recording — across different individuals, ensuring that each step is subject to independent review before or after it occurs.

The most critical incompatible duty combination in wealth operations is the combination of initiation and authorization for high-value cash movements: a single person who can both create and approve wire transfers can misappropriate client assets without any independent check. System-enforced SOD is categorically more reliable than policy-only SOD because it creates structural obstacles to circumvention rather than behavioral expectations.

When full SOD is not achievable due to staffing constraints, the appropriate response is to document the specific conflicts, identify the risks they create, implement formally designed compensating controls, and subject those controls to independent monitoring. Compensating controls do not eliminate conflict risk but reduce it to within the firm's tolerance — and documenting them demonstrates to regulators that the firm manages its control gaps actively rather than ignoring them.

SOD is not a one-time configuration: it must be maintained through periodic access reviews, updated when staff or systems change, and incorporated into every new product or process design.

Looking Ahead

Lesson 24.3 examines dual authorization requirements — the specific implementation of SOD principles applied to the authorization function for high-risk transactions. Where this lesson established the principle that authorization must be independent of initiation, the next lesson examines in operational detail what "dual authorization" means in practice: how dual authorization requirements are defined by transaction type and threshold, how the authorization process works in automated and manual environments, how dual authorization is documented and verified, and what happens when dual authorization cannot be obtained.

The SOD matrix concept introduced in this lesson — mapping functions to roles and identifying conflicts — reappears in Lesson 24.4 as the basis for designing access control systems, which are the primary technology mechanism for enforcing SOD in digital operations environments.

Study Support

How to Approach This Lesson

The core intellectual exercise in this lesson is learning to see any operational process as a sequence of functions, and evaluating who performs each function. Wherever a single person performs two or more of the four key functions — initiate, authorize, execute, record — there is a potential SOD conflict worth examining. Practice applying this decomposition to every operational scenario you encounter: can one person complete this entire process alone? If yes, what stops them from doing so fraudulently?

Key Patterns to Recognize

• Custody plus recording is the highest-risk SOD combination: the person holding assets can manipulate the record to conceal misappropriation.
• Initiation plus authorization is the most common SOD failure in small wealth management firms.
• System enforcement is the gold standard; policy-only controls are vulnerable to circumvention under pressure.
• Residual access from prior roles is the most common cause of unintended SOD conflicts — periodic access reviews are the primary detective control for this failure mode.
• Compensating controls must be documented and independently monitored to be meaningful to regulators.

Questions to Test Your Understanding

• Can you name the four transaction functions and explain why combining any two in a single person creates an SOD concern?
• Can you design a simple SOD matrix for a three-person operations team?
• Can you explain the difference between system-enforced and policy-only SOD and why it matters?
• Can you describe what a compensating control for an SOD conflict should look like to be considered adequate?
• Can you identify an SOD conflict in a described scenario and explain what risk it creates?

Common Areas of Confusion

The most common confusion involves compensating controls: students sometimes think that a compensating control is equivalent to true SOD and that an organization with good compensating controls has no SOD problem. Compensating controls reduce the risk created by an SOD conflict but they do not eliminate the conflict. A compensating control is a second-best solution that is appropriate when SOD is genuinely impractical — it is not an acceptable permanent substitute for achievable SOD. The second common confusion involves system-enforced versus policy-only SOD: students sometimes interpret "the policy says no one should both initiate and approve" as equivalent to "the system prevents anyone from doing so." These are categorically different: one requires voluntary compliance; the other creates a structural barrier.

Practical Application

Application 1: Conducting an SOD Assessment

In practice, compliance officers and internal auditors conduct SOD assessments by combining system access reviews with organizational structure analysis. The access review pulls a list of all users in the transaction processing systems and their assigned roles, then maps each user's roles to the four functional categories. The organizational review maps each user's job description and actual daily responsibilities to the same functional categories. The combined picture reveals where system access and organizational responsibility diverge — a person with only initiator access in the system might be acting as a de facto approver because the approver defers to their judgment, a form of SOD failure that system access reviews alone will not detect.

Application 2: Implementing SOD in Small Firm Environments

Many compliance consultants working with small RIAs implement a practical two-person SOD structure for wire transfer processing: the operations staff member (or client service staff) initiates the wire in the system and sends a confirmation to the principal; the principal independently verifies the instruction against client records, calls back the client for wires above a threshold, and approves the wire using separate credentials. This structure achieves the most critical SOD separation — initiation separate from authorization — even in a two-person environment. The custodian's daily wire confirmation, sent to an address that only the principal reviews, serves as an additional detective control that catches any wire processed without the principal's awareness.

Application 3: Role Transition SOD Review

Best practice in operations management is to perform an access review and SOD check every time a staff member changes roles — not just at the annual review cycle. When an operations specialist is promoted to operations manager, the review should confirm: (1) new approver access has been granted; (2) old initiator access has been removed; (3) the SOD matrix has been updated to reflect the new access configuration; and (4) any transactions processed during the transition period (when the staff member temporarily held both roles) have been reviewed for SOD compliance. The transition period is the most common source of the residual access conflicts that accumulate into significant SOD gaps over time.

Application 4: Documenting SOD for Regulatory Examination

When a regulatory examiner requests SOD documentation, the firm should be able to provide: the SOD matrix identifying all roles, the functions each role can perform, and any identified conflicts; the compensating controls documented for each conflict; evidence that compensating controls are being actively performed (supervisory review logs, for example); the most recent access review report and its findings; and the remediation status of any findings from prior reviews. Firms that can produce this documentation demonstrate a functioning SOD management process. Firms that cannot — who must reconstruct this documentation under examination pressure — demonstrate exactly the monitoring failure that the examiner is looking for.

Lesson Navigation