Separation of Duties, also referred to as Segregation of Duties (SoD), is a foundational internal control principle requiring that critical responsibilities be appropriately distributed to reduce the risk that any one individual could initiate, authorize, execute, conceal, or independently validate an unauthorized or inappropriate activity. SoD helps prevent or detect errors, misuse, fraud, unauthorized access, inappropriate data modification, and security or privacy incidents. The nature and extent of required separation shall be commensurate with the sensitivity of the data, criticality of the system or process, level of privileged access, applicable legal or regulatory requirements, and the reasonably foreseeable impact of unauthorized or erroneous activity.
When incompatible responsibilities cannot reasonably be separated, management shall identify the associated risk and implement documented compensating controls that provide appropriate independent oversight. These control areas are intended to prevent any individual from independently creating, modifying, deleting, approving, deploying, administering, and validating significant data or system activity without appropriate independent oversight or documented compensating controls. When applied to data governance, these map directly onto roles such as data stewards, data custodians, system administrators, developers, and auditors, ensuring that sensitive data cannot be created, changed, accessed, and approved by the same person.
Actual Duties That Commonly Conflict Under SoD for Data Operations
Below are the most relevant SoD conflicts for data governance:
| Duties | Conflicts | Reason |
| Provisioning vs. Approving Access | The person who grants system or data access should not also approve that access. | Prevents privilege escalation and unauthorized access. |
| Data Creation/Modification, Deletion vs. Data Approval | A data steward who creates or updates sensitive data should not also approve or certify it. | Prevents unauthorized changes and insider threats. |
| Security Role Design/Configuration vs. Role Assignment/Provisioning | The person defining system roles or permissions should not also assign those permissions to users. | Prevents role abuse and privilege stacking. |
| Data Custody vs. Data Audit/Monitoring | System administrators with broad access should not audit logs or monitor their own activity. | Ensures independent oversight. |
| Transaction Entry vs. Reconciliation | Individuals entering data (financial, HR, student records) should not reconcile or certify the same data. | Prevents concealment of errors or fraud. |