Segregation of duties conflicts
Users able to create and approve the same transaction, maintain a vendor and pay it, or post and reconcile the same account — reported where the conflict was exercised, not just held.
RISK COVERAGE
Internal Controls & Access Analytics
Design effectiveness is a document. Operating effectiveness is in the transaction log. These analytics test the second one.
Most control testing evaluates whether a control exists and whether a sample of transactions complied. That approach misses the case where the control was configured correctly and then overridden, or where a user held conflicting rights for three weeks during a system migration.
foretale.ai tests controls against actual transaction and authorisation data. It compares the rights users hold with the actions they took, and reports where the two combine into a real exposure rather than a theoretical one.
WHAT WE DETECT
Risks tested in this domain
Approval limit violations
Transactions approved above delegated authority, self-approval, and approval by a subordinate of the requester.
Control override detection
Tolerance and matching controls bypassed, blocked vendors released for payment, and manual overrides concentrated among a few users.
Access and authorisation risk
Dormant accounts with live privileges, shared or generic accounts, privileged access granted outside change process, and rights not removed after role change.
Privileged and emergency access
Firefighter or emergency access used without an incident record, and privileged sessions with no documented review.
Control effectiveness over time
Exception rates trending by process, entity, and approver, showing where a control is degrading before it fails.
HOW IT RUNS
Understand → Plan → Execute → Explain
foretale.ai maps your data and relationships, plans the analytics for this domain, tests the full population, and returns findings with evidence attached. Your team keeps every judgement.
DATA USED
What we need from your systems
- User master and role assignments
- Authorisation objects and permission sets
- Transaction and posting logs by user
- Approval workflow and delegation records
- Change and configuration logs
- Joiner, mover, and leaver records
Related reading
Frequently asked questions
What is segregation of duties analytics?
Segregation of duties analytics test whether any single user can complete a sensitive process end to end without independent review — for example creating a vendor and then paying it. The important refinement is exercised conflict: reporting not only users who hold a conflicting combination of rights, but those who actually performed both sides of the transaction, which is a far smaller and more actionable population.
How do you test control override?
By identifying transactions where a configured control was bypassed rather than satisfied — a matching tolerance overridden, a blocked vendor released, an approval step skipped. Concentration is the key signal: overrides clustered among a few users, entities, or periods indicate a control that is effectively optional.
Can you find access risk that existed only temporarily?
Yes. Because role assignment history is analysed alongside transaction logs, conflicts that existed for a limited window — typically during migrations, secondments, or leave cover — are detected even if the access has since been removed.
Does this support SOX or internal audit control testing?
Yes. Findings include the population tested, the exceptions identified, and the underlying transactions with lineage, which is the evidence format control testing and audit documentation require.
NEXT STEP
See it on your data.
Request a focused walkthrough—usually within one business day.