Separation of duties (SoD)

Separation of duties (SoD) prevents one person from holding responsibilities that must stay apart: whoever prepares the payroll should not also be the one who audits it or books it in the accounts. Illizeo blocks these combinations when you add a member to a role, and only accepts an exception with a justification, recorded in the role’s history. This article is intended for administrators who manage roles.

Before you start #

• To add members to a role, and therefore to override, you need the “Add an individual member” permission (Roles & permissions › Members section of the role matrix) at the Execute level. To see the members tab, you need “View role members”.
• To review an override: “View the change log” (Roles & permissions › History).
• These pages are in Settings: you also need “Settings — Access”. By default, only the Administrator role holds all these permissions.
• Role management itself is covered in Permissions & roles.

The forbidden combinations #

• These rules are set by Illizeo and apply to every space; they cannot be changed from your space.
• They apply to these three predefined roles, even if you have renamed them. Roles you create are not affected.

Where the check applies #

The check takes place when you add individual members to one of these roles:

1. Open Settings › Manage Employees › Employee Roles and select the role, for example Payroll Manager.
2. Open the Authorized population tab.
3. In the Individual members block, click + Add and choose the people.
4. Click Confirm.

If none of the chosen people holds an incompatible role, they are added. Otherwise, nobody is added and the “Separation-of-duties conflict” window opens.

Overriding with a justification #

The “Separation-of-duties conflict” window explains that the assignment gives conflicting duties to the same employee, and lists each person concerned with the role they already hold that creates the conflict.

1. If the combination is not intended, click Cancel: nobody is added. Then remove the person from your selection, or first remove the other role from them.
2. If the exception is justified (small organisation, interim cover, replacement), enter the Override justification. It is mandatory.
3. Click Override & add. The message “Override applied — member(s) added.” confirms that everyone in the selection has been added.

Finding an override #

Open the role, then its History tab: it lists the changes made to the role, with their author and date. An override appears on a line whose detail reads “Separation-of-duties override” (in the language of the person who made it), together with the “Member added” line naming the people added.

The justification entered is stored with the override, but the role history does not display it. If you need to produce it during an inspection, also record it in your own register.

Good to know #

• The check only covers adding individual members from a role’s Authorized population tab. It does not apply when a role is assigned from the Roles tab of an employee’s profile, nor to members added by criteria or by directory group.
• Only newly added people are checked: an existing combination is not flagged, neither by this check nor by the access review. To spot one, compare the members of the Payroll Manager, Auditor and Accounting roles.
• In the conflict window, the role at issue is shown by its technical identifier (auditor for Auditor, accounting for Accounting).

FAQ #

Can we add our own incompatibility rules? #

No. The forbidden combinations are set by Illizeo.

I clicked Cancel. Were the other people in my selection added? #

No. As long as one person in the selection is in conflict, nobody is added. Redo the selection without them, or override for everyone.