SoD Violations
Distinguish a theoretical SoD conflict from an actual violation — a user who genuinely executed both conflicting actions.
- Ledger + user role assignments
- Key analysis in IT controls
How the result is read
Held versus exercised is what makes the result usable: the matrix against role assignments alone produces hundreds of theoretical conflicts nobody can work through, while intersected with what was executed it produces the few that matter. Both are reported, as two populations with different responses. Access exercised through a shared account or a delegation defeats a user-keyed test, so those routes are identified rather than assumed away.
The worksheet, on the demo engagement
SoD Violations, as the application draws it for Harrow Precision Engineering Ltd, the fictional demo engagement — one row per user per conflict rule.
- Conflict rules evaluated
- 48
- Potential violations
- 5
- Actual violations (executed)
- 3
- High-risk actual
- 2
SoD cross-references access rights with actual executed transactions (ISA 315).
Result grid5 rows
| User | SoD conflict rule | Step A executed | Step B executed | Date A | Date B |
|---|---|---|---|---|---|
| R.Kahn (temp) | Vendor create AND vendor pay | Created Orion Supplies in vendor master | Approved PI-66130 + PI-66140 | 2024-12-18 | 12-18 to 12-20 |
| J.Smith (Controller) | JE prepare AND JE approve | Prepared JV-44120 (Prof. fees 902) | Approved JV-44120 (same user ID) | 2024-12-31 | 2024-12-31 |
| A.Lee (GL clerk) | Post JE without approver | Posted JV-44131 (Suspense 318) | No approver — unilateral post | 2024-12-31 | — |
| J.Smith (Controller) | Vendor create AND vendor pay (right only) | Has VM_Create system role | Has AP_Approve system role | — | — |
| SYSTEM | Automated — no SoD conflict | — | — | — | — |
In the application
SoD Violations is filed under IT controls, index letter K. "Run all analyses" runs it with every other analysis the ledger and the documents loaded can answer. The worksheet states the population it tested on its face — or "Not applicable" with the reason when a column it depends on is empty — and the Excel workbook the engagement exports files it under K, beside an index of the source files with their SHA-256 fingerprints.
Read it with
Run your next audit file test without the Excel crash.
One free engagement to evaluate, valid 60 days. The ledger never leaves the machine.
- 20 minutes
- Runs on a fictional engagement
- No client data required