Lion Cipher Lab
Build a segregation-of-duties matrix and find the toxic combinations
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Segregation of Duties is one of those controls that sounds bureaucratic until you see what it prevents: a single employee who can both create a fake vendor and approve payments to it can quietly drain a company, and the reason so many real frauds run for years is that one person owned the whole chain and there was no second pair of eyes by design. That is exactly the hole SoD closes -- it forces a transaction to pass through more than one person, so committing or hiding wrongdoing needs collusion rather than just opportunity. Auditors ask for a segregation-of-duties matrix on almost every…
What you'll learn
- explaining Segregation of Duties (SoD) in plain words: no single person should control a whole transaction end-to-end, because the same person who can CREATE something and APPROVE it can commit fraud or hide an error with nobody the wiser
- naming the four classic incompatible duty types that a control framework separates -- authorisation, custody, record-keeping, and reconciliation -- and why concentrating two of them in one role is the risk
- identifying 'toxic combinations' (a.k.a. SoD conflicts): specific pairs of duties that must not sit with one person, such as create-vendor + approve-payment, or request-access + grant-access
- building a real SoD conflict matrix for a business process: duties down the rows and across the columns, each cell marked as a conflict or allowed, so the whole set of dangerous pairings is visible at a glance
- mapping which roles/people actually hold which duties and OVERLAYING that on the matrix to find where a real person currently sits on both sides of a conflict -- the actual exposure, not the theoretical one
- measuring the before state: counting how many live toxic combinations exist in the current design
- remediating each conflict by the right method: SEPARATE the duties across two people where the org is big enough, or -- where it genuinely cannot -- apply a documented COMPENSATING CONTROL (independent review, dual approval, after-the-fact monitoring) and record why
- the judgment small organisations actually face: with only a handful of staff, perfect separation is impossible, so the professional answer is a risk-accepted conflict WITH an evidenced compensating control, not a pretend-clean matrix
- producing the auditable output an ITGC/SOX-style or ISO audit expects: the matrix, the conflict list, and for every unresolved conflict a named compensating control and owner -- and reporting the residual conflict count
- placing SoD in the control frameworks -- NIST SP 800-53 AC-5 (Separation of Duties) and its role in SOX IT general controls -- so you can speak an auditor's language
Steps in this lab
- What Segregation of Duties actually prevents
- Pick a process and list its duties
- Build the conflict matrix
- Overlay real people — find the LIVE conflicts
- Resolve each conflict — separate, or compensate
- Measure the after state and report it honestly
- The honest limits