Testing segregation of duties within an ERP means extracting the actual access rights assigned to every user — down to the transaction code, menu path, or role object the ERP uses — and running that extract against a predefined conflict matrix of incompatible combinations, such as the ability to both create a vendor and approve a payment, or both post a journal entry and approve its posting, rather than inferring segregation from job titles or an organisation chart, which show intended structure but not actual system entitlement.
Why the org chart test is not enough
An org chart shows who is supposed to do what. ERP access control shows who can actually do what, and the two routinely diverge: a user who moved from accounts payable to treasury often keeps the AP access rights from the old role because deprovisioning is a manual, easily skipped step; a temporary access grant for a one-off task is rarely revoked once the task is done; and a generic or shared login used for system maintenance can carry a combination of rights no single named employee would be given. None of this shows up in a review of role descriptions.
Building and running the conflict matrix
- 01Define the conflict matrix at the transaction or function level, not the job-title levelList specific incompatible pairs — vendor master maintenance versus payment approval, purchase order creation versus goods receipt, journal entry posting versus journal entry approval — mapped to the ERP's own transaction codes or role names.
- 02Extract the full user-to-access mapping from the ERPThis needs to include every role and every directly assigned authorization a user holds, not just their primary role, since conflicts often arise from an accumulation of secondary or legacy access.
- 03Run the extract against the conflict matrix for every active userThis is a mechanical cross-reference once both the matrix and the extract are available, and should be run at full population, not on a sample of users.
- 04For each conflict identified, assess whether a compensating control existsA genuine conflict is not automatically a finding if an independent review control catches the same risk — but the compensating control itself then needs to be tested for whether it actually operates.
Conflicts arising from leftover access after an internal transfer are far more common than conflicts built into the original role design, and they accumulate silently over time. A segregation-of-duties review that only looks at current role definitions, without checking what access individual users actually carry, will miss this category entirely.
How we think about this
Cross-referencing a full user-access extract against a conflict matrix is exhaustive, repeatable work that a tool should do for every user and every conflict pair, every time. Deciding whether a flagged conflict is adequately compensated by another control is the judgement that still needs a reviewer.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCTesting segregation of duties: a practical approachThe classic SoD conflicts, how to test for them in a small finance team where perfect separation is not realistic, and how to document the compensating controls that stand in.
- Internal audit & IFCIFC testing: internal financial controls over financial reportingHow IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
- Internal audit & IFCBuilding a risk control matrix (RCM) for audit testingHow to structure an RCM so it actually drives testing, map it to financial statement assertions, and stop it from becoming the document nobody updates after the first year.
- Technology, data & AI in auditThe audit trail rule: what accounting software must doThe feature is usually present in the software and switched off, not missing. How to actually test which one is true before relying on it.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.