DEFINITION
Segregation of Duties
Segregation of duties is the control principle that no single person should be able to complete a sensitive business process end to end without independent review. Typical conflicts include creating a vendor and paying it, or posting a journal and approving it.
Most segregation of duties reporting lists users who hold a conflicting combination of access rights. That population is usually large and mostly theoretical, because holding conflicting rights is not the same as using them.
The more actionable measure is the exercised conflict: users who actually performed both sides of a sensitive transaction. This population is far smaller, is evidenced by transaction records rather than role configuration, and represents realised rather than potential exposure.