Segregation of Duties (SoD) Matrix & Conflict Defense
Detecting toxic permission pairs, blocking conflicting assignments, configuring exception policies, and managing compensating controls.
Segregation of Duties (SoD) prevents conflicting privileges that expose the enterprise to fraud, unauthorized disbursement, or compliance failure.
Toxic Permission Pairs Matrix#
SmartERP maintains pre-configured conflicting pairs in smarterp.rbac.sod.rule:
| Primary Role | Conflicting Role | Severity | Operational Risk Rationale |
|---|---|---|---|
| Vendor Master Data Creation | Vendor Payment Approval | blocking | An individual could create a fictitious vendor and approve disbursement to personal accounts. |
| Sales Order Creation | Customer Credit Limit Override | warning | Sales rep could bypass credit controls for insolvent customers. |
| Physical Inventory Custody | Inventory Write-off & Adjustment | blocking | Warehouse keeper could conceal physical inventory theft via ledger write-offs. |
| Payroll Processing | Bank Account Ledger Reconciliation | blocking | Payroll officer could alter salary disbursements without independent treasury audit. |
Exception Management & Compensating Controls#
In small branches where complete role segregation is impossible, an authorized exception can be granted (smarterp.rbac.sod.exception):
- Dual Authorization Required: Must be approved by both the Managing Director and the Internal Audit Lead.
- Documented Compensating Control: Must specify an alternative audit mechanism (e.g., "Daily automated disbursement exception report sent to CFO").
- Hard Expiration: Exceptions expire automatically after a maximum of 90 days.
Last updated: 2026-10-16