Updated 31 October 2026
An SoD conflict is a pair of tasks that lets one person do something alone that should take two people. The most serious ones usually involve vendors, bank details and payments.
Purchase to pay
| The conflict | What could go wrong | What usually helps |
|---|---|---|
| Create a vendor + run the payment | A payment to a vendor that doesn't exist | Keep vendor master data apart from payments |
| Change bank details + run the payment | A real payment goes to another account | Dual control on bank detail changes |
| Create a vendor + post an invoice | A made-up supplier with a made-up invoice | Central vendor maintenance |
| Post an invoice + run the payment | No second pair of eyes on the money | Separate accounts payable from payment release |
| Create a purchase order + confirm goods receipt | Goods confirmed that never arrived | Goods receipt by the warehouse, not by the buyer |
Order to cash
| The conflict | What could go wrong | What usually helps |
|---|---|---|
| Create a customer + post a credit note | Credit to a customer that doesn't exist | Approval for credit notes above a limit |
| Post incoming payments + post a credit note | A payment taken and hidden with a credit | Keep cash handling apart from credits |
Finance
| The conflict | What could go wrong | What usually helps |
|---|---|---|
| Maintain G/L accounts + post journal entries | A new account used to hide an entry | Central master data, review of new accounts |
IT
| The conflict | What could go wrong | What usually helps |
|---|---|---|
| Create users + assign roles | A new account with any access | Approved requests, review of the change log |
| Change roles + assign roles | Someone grants themselves more access | Separate role build from role assignment |
When you can't split the work
In a smaller team, the same person sometimes has to do both tasks. That's where a compensating control comes in: a regular independent review, such as someone checking the payment list against the invoices. Write down who does it and when, and keep the evidence.
These are illustrative examples. Your own ruleset decides what counts as a conflict.
Questions about SoD conflicts
What is an example of a segregation of duties conflict?
A classic example is one person who can both create a vendor and run the payment. That person could pay a vendor that doesn't exist, with nobody else involved.
Are all SoD conflicts equally serious?
No. A conflict that can move money usually matters more than one that can only change a report. That's why rating them is the first step.
Is an SoD conflict the same as fraud?
No. A conflict shows what someone could do, not what they did. Most conflicts come from how roles have grown, not from bad intent.
