---
title: Separation of duties (SoD)
description: The forbidden role combinations, the check when adding a member, the justified override and where it is recorded.
url: "https://illizeo.com/en/centre-aide/governance-separation-of-duties/"
updated: "2026-11-05"
category: "Platform / Governance & security"
---

# Separation of duties (SoD)

Separation of duties (SoD) prevents one person from holding responsibilities that must stay apart: whoever prepares the payroll should not also be the one who audits it or books it in the accounts. Illizeo blocks these combinations when you add a member to a role, and only accepts an exception with a justification, recorded in the role's history. This article is intended for administrators who manage roles.

## Before you start

- To add members to a role, and therefore to override, you need the "Add an individual member" permission (Roles & permissions › Members section of the role matrix) at the **Execute** level. To see the members tab, you need "View role members".
- To review an override: "View the change log" (Roles & permissions › History).
- These pages are in Settings: you also need "Settings — Access". By default, only the Administrator role holds all these permissions.
- Role management itself is covered in [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/).

## The forbidden combinations

| Role | Incompatible with | Why |
| --- | --- | --- |
| Payroll Manager | Auditor | Whoever produces the payroll does not audit it. |
| Payroll Manager | Accounting | Whoever produces the payroll does not book it in the accounts. |

- These rules are set by Illizeo and apply to every space; they cannot be changed from your space.
- They apply to these three predefined roles, even if you have renamed them. Roles you create are not affected.

## Where the check applies

The check takes place when you add individual members to one of these roles:

1. Open **Settings › Manage Employees › Employee Roles** and select the role, for example Payroll Manager.
2. Open the **Authorized population** tab.
3. In the **Individual members** block, click **+ Add** and choose the people.
4. Click **Confirm**.

![The Employee Roles page with the Payroll Manager role selected, Authorized population tab: Individual members block with the + Add button, then the Automatic members block](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-separation-of-duties-01.en_.png?resize=800%2C500&quality=80&ssl=1)
Payroll Manager role, Authorized population tab.

If none of the chosen people holds an incompatible role, they are added. Otherwise, nobody is added and the "Separation-of-duties conflict" window opens.

![The Individual members block in add mode: choosing the people to add to the Payroll Manager role, before the Confirm button](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-separation-of-duties-02.en_.png?resize=800%2C200&quality=80&ssl=1)
+ Add: choose the people, then Confirm. The check runs on confirmation.

## Overriding with a justification

The "Separation-of-duties conflict" window explains that the assignment gives conflicting duties to the same employee, and lists each person concerned with the role they already hold that creates the conflict.

1. If the combination is not intended, click **Cancel**: nobody is added. Then remove the person from your selection, or first remove the other role from them.
2. If the exception is justified (small organisation, interim cover, replacement), enter the **Override justification**. It is mandatory.
3. Click **Override & add**. The message "Override applied — member(s) added." confirms that everyone in the selection has been added.

## Finding an override

Open the role, then its **History** tab: it lists the changes made to the role, with their author and date. An override appears on a line whose detail reads "Separation-of-duties override" (in the language of the person who made it), together with the "Member added" line naming the people added.

![The History tab of the Administrator role, with the Export matrix button; no change has been recorded yet in the demo workspace](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/governance-separation-of-duties-03.en_.png?resize=800%2C114&quality=80&ssl=1)
The role's History tab: where changes and overrides are recorded.

The justification entered is stored with the override, but the role history does not display it. If you need to produce it during an inspection, also record it in your own register.

## Good to know

- The check only covers adding individual members from a role's **Authorized population** tab. It does not apply when a role is assigned from the **Roles** tab of an employee's profile, nor to members added by criteria or by directory group.
- Only newly added people are checked: an existing combination is not flagged, neither by this check nor by the [access review](https://illizeo.com/en/centre-aide/governance-access-review/). To spot one, compare the members of the Payroll Manager, Auditor and Accounting roles.
- In the conflict window, the role at issue is shown by its technical identifier (`auditor` for Auditor, `accounting` for Accounting).

## FAQ

### Can we add our own incompatibility rules?

No. The forbidden combinations are set by Illizeo.

### I clicked Cancel. Were the other people in my selection added?

No. As long as one person in the selection is in conflict, nobody is added. Redo the selection without them, or override for everyone.

### *Similaire*