Segregation of duties (SoD)

Roles that need it

• Internal Auditor
• IT Auditor
• Operational Risk Analyst
• General Accountant
• Treasury Operations Analyst

Skills it belongs to

• Internal controls and risk oversight
• Identity and access management
• Control mindset (what could go wrong)

Related concepts

• Key controlA key control is a control that on its own, or with a few others, prevents or detects a material error or a significant risk. Key controls are documented with an owner, frequency and evidence, and are tested more often than other controls.
• SOX controls (ICFR)SOX controls are the internal controls over financial reporting (ICFR) that US-listed companies must document, test and report on under the Sarbanes-Oxley Act, sections 302 and 404. Management assesses them each year and, for larger filers, the external auditor gives an opinion on their effectiveness.
• Control testing (design and operating effectiveness)Control testing checks whether a control is well designed to address its risk (design effectiveness) and whether it worked as intended over a period (operating effectiveness). Testers walk through the process, sample instances and inspect evidence.

Sources

• AS 2201 An Audit of Internal Control Over Financial Reporting, PCAOB (external site) accessed 31 Oct 2026
• Corporate governance principles for banks, BIS (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.