Segregation of Duties and Logical Access Guide

This guide can be used by auditors looking to better understand segregation of duties (SOD) processes and best practices.

The basic idea underlying SOD is that no employee or group of employees should be in a position both to perpetrate and to conceal errors or fraud in the normal course of their duties. In general, the principal incompatible duties to be segregated are assets custody, authorizing or approving related transactions affecting those assets, and recording or reporting related transactions. Traditional systems of internal control rely on assigning certain responsibilities to different individuals or segregating incompatible functions.