{
 "slug": "sod-exception-evidence",
 "topic_id": "TOPIC-216",
 "cluster": "Enterprise IGA, Access Certification & Identity Lifecycle",
 "tier": "Tier A",
 "title": "Segregation of duties exceptions: the compensating control that compensates for nothing",
 "summary": "An SoD conflict is accepted because the business needs it. The register records an approver, a date and a free-text compensating control, and whether that control was ever operated is untestable.",
 "lede": "Every ERP estate has an exception register. It is the document an ITGC auditor samples first, and it is a list of accepted risks whose mitigations are described in prose and evidenced by nothing.",
 "date": "2025-11-09",
 "category": "Developer",
 "author_id": "nadia-ferreira-strand",
 "tags": [
  "segregation of duties",
  "SoD",
  "ITGC",
  "compensating controls",
  "GRC",
  "SOX"
 ],
 "image_title": "SoD Exception Evidence",
 "schema": "Article",
 "key_takeaways": [
  "Exception approval is a GRC workflow with text fields. The conflict is rendered as rule codes and the compensating control is an assertion with no operating evidence linked to it.",
  "An exception register grows monotonically because nothing forces re-evaluation, and stale exceptions accumulate at the rate of ERP change.",
  "Linking each operation of the compensating control to the exception makes the register testable end to end."
 ],
 "body": [
  {
   "type": "h2",
   "text": "Prerequisites"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "A conflict, an acceptance and an unverified mitigation",
   "caption": "The acceptance is documented. The mitigation is asserted.",
   "nodes": [
    {
     "label": "SoD conflict detected",
     "sub": "by the tool",
     "note": "good"
    },
    {
     "label": "Business justifies it",
     "sub": "legitimately",
     "note": "often true"
    },
    {
     "label": "Compensating control recorded",
     "sub": "free text",
     "note": "unverified",
     "bad": true
    },
    {
     "label": "Exception persists",
     "sub": "renewed annually",
     "note": "unchecked",
     "bad": true
    }
   ]
  },
  {
   "type": "ul",
   "items": [
    "Your current SoD exception register, exported.",
    "The ruleset that generated the conflicts, with its version history.",
    "For a sample of ten exceptions, whatever evidence exists that the compensating control operated in the last quarter."
   ]
  },
  {
   "type": "h2",
   "text": "Step 1 — Age the register"
  },
  {
   "type": "p",
   "html": "Sort exceptions by approval date and plot the distribution. The shape tells you most of what you need."
  },
  {
   "type": "table",
   "head": [
    "Age of exception",
    "What it usually means"
   ],
   "rows": [
    [
     "Under 6 months",
     "Active business need, recently justified"
    ],
    [
     "6–18 months",
     "Re-approved at least once, probably without re-examination"
    ],
    [
     "Over 18 months",
     "The original justification is unverifiable; the person who wrote it may have left"
    ],
    [
     "Over 3 years",
     "Structural — the conflict is how the business runs and the exception is fiction"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The bottom two rows are usually the majority. An exception register that only grows is not managing risk; it is recording the accumulation of it."
  },
  {
   "type": "h2",
   "text": "Step 2 — Test the compensating controls"
  },
  {
   "type": "p",
   "html": "Take ten exceptions and ask, for each: what evidence exists that the stated compensating control operated during the last quarter?"
  },
  {
   "type": "p",
   "html": "Common compensating controls and what evidence typically exists:"
  },
  {
   "type": "table",
   "head": [
    "Stated compensating control",
    "Evidence that usually exists"
   ],
   "rows": [
    [
     "Monthly review of transactions by the manager",
     "A calendar invite, sometimes"
    ],
    [
     "Exception report reviewed by finance",
     "The report exists; review is unevidenced"
    ],
    [
     "Dual approval on affected transactions",
     "In the ERP, if configured — frequently it is not"
    ],
    [
     "Post-transaction audit sampling",
     "Internal audit workpapers, if the sample covered it"
    ],
    [
     "Systemic monitoring alerts",
     "Alert configuration; nobody checks whether alerts fired or were actioned"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Rows one, two and five are where the sampling fails. The control is described as operating and nothing records that it did."
  },
  {
   "type": "h2",
   "text": "Step 3 — Render the conflict in business terms"
  },
  {
   "type": "p",
   "html": "An approver signing off an SoD exception is typically shown a rule code and a technical description: <em>SOD-P2P-014: Create Vendor / Post Invoice</em>."
  },
  {
   "type": "p",
   "html": "What they need to see is the business consequence: <em>this person can create a vendor and then pay it, without another human being involved.</em> The second formulation produces different approval decisions than the first, and it costs nothing but the description."
  },
  {
   "type": "h2",
   "text": "Step 4 — The Exception Evidence Standard"
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"sod_exception_approval\",\n  \"render\": [\n    \"Conflict: [business-language description of what becomes possible]\",\n    \"Ruleset: [id, version]\",\n    \"Individual: [name, role]\",\n    \"Business justification: [text as written]\",\n    \"Compensating control: [named control]\",\n    \"Control cadence: [monthly | per transaction | quarterly]\",\n    \"Expiry: [date]\"\n  ],\n  \"approver\": \"[credential assertion]\",\n  \"control_owner\": \"[credential assertion]\"\n}"
  },
  {
   "type": "p",
   "html": "Two signatures. The approver accepts the risk; the control owner accepts responsibility for operating the mitigation. Today the second person frequently does not know they have been named."
  },
  {
   "type": "h2",
   "text": "Step 5 — Link the control operations"
  },
  {
   "type": "p",
   "html": "This is the step that makes the register testable. Each operation of the compensating control emits its own receipt referencing the exception."
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"compensating_control_operated\",\n  \"exception\": \"[reference to the approval receipt]\",\n  \"period\": \"[month covered]\",\n  \"scope\": \"[transactions reviewed: count, value]\",\n  \"exceptions_found\": \"[count]\",\n  \"operator\": \"[credential assertion]\"\n}"
  },
  {
   "type": "p",
   "html": "An auditor sampling the register can now follow an exception to its control operations and verify both. That is a different testing experience from reading a spreadsheet and asking for screenshots."
  },
  {
   "type": "h2",
   "text": "Failure traps"
  },
  {
   "type": "ol",
   "items": [
    "Setting expiry too long. Twelve months means one re-approval per year and re-approvals are rubber-stamped; six months with a business-language rendering produces actual re-examination.",
    "Naming a compensating control nobody owns. If the control owner will not sign, the control does not exist and the exception should be re-evaluated.",
    "Instrumenting the approval and not the control operations. That produces a well-evidenced record of accepting a risk and no evidence of mitigating it.",
    "Keeping structural exceptions in the register. If the conflict is how the business runs, the answer is a process change or a documented risk acceptance at a higher level — not an exception renewed forever."
   ]
  },
  {
   "type": "h2",
   "text": "What a compensating control must have to count"
  },
  {
   "type": "table",
   "caption": "Four properties, and how often they are present",
   "head": [
    "Property",
    "Usually present?"
   ],
   "rows": [
    [
     "A named owner",
     "Sometimes"
    ],
    [
     "A defined operating frequency",
     "Rarely"
    ],
    [
     "Evidence it operated",
     "<strong style=\"font-weight:600\">Almost never</strong>"
    ],
    [
     "A test that would fail if it stopped",
     "<strong style=\"font-weight:600\">Almost never</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "A compensating control that nobody can show operating is a sentence in a register. Auditors accept them because the alternative is a finding on every exception, and the acceptance becomes permanent because nothing triggers a review."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Exceptions are reviewed annually.”</strong> The exception is reviewed — whether the conflict is still needed. The compensating control is usually re-copied rather than re-tested."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Small teams cannot segregate everything.”</strong> True, and that is the legitimate case for exceptions. It is an argument for evidencing the mitigation properly, not for accepting an unverifiable one."
  }
 ],
 "faq": [
  {
   "q": "What if the compensating control genuinely cannot be evidenced?",
   "a": "Then it is not a control, and the exception is an unmitigated accepted risk. Recording it as such is more honest and escalates it to the right level."
  },
  {
   "q": "Will this shrink the exception register?",
   "a": "Usually, because requiring a control owner's signature surfaces exceptions whose mitigations were nominal. That shrinkage is the point."
  },
  {
   "q": "Does this replace the GRC platform?",
   "a": "No. The receipts sit alongside the platform's records and make them verifiable by a party who does not have access to it."
  },
  {
   "q": "How does this affect ITGC testing?",
   "a": "Sampling becomes verification rather than document review, which shortens testing and strengthens the evidence."
  },
  {
   "q": "Why are compensating controls rarely tested?",
   "a": "Because the register records a description rather than an owner, a frequency and evidence of operation."
  },
  {
   "q": "Are SoD exceptions inherently bad?",
   "a": "No. Small teams legitimately cannot segregate everything. The problem is accepting a mitigation nobody can show operating."
  },
  {
   "q": "What is the single best change?",
   "a": "Expire exceptions by default, so renewal is a decision rather than an inheritance."
  }
 ],
 "sources": [
  {
   "t": "PCAOB AS 2201 — An Audit of Internal Control Over Financial Reporting",
   "u": "https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201"
  },
  {
   "t": "ISACA — identity and access management audit resources",
   "u": "https://www.isaca.org/resources"
  },
  {
   "t": "CISA — known exploited vulnerabilities and incident reporting",
   "u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
  },
  {
   "t": "NIST SP 800-53 Rev. 5 — access enforcement",
   "u": "https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"
  }
 ],
 "related": [
  {
   "slug": "certification-evidence-standard",
   "title": "The rubber stamp is the product",
   "category": "Developer"
  },
  {
   "slug": "re-performable-evidence",
   "title": "Replacing the screenshot",
   "category": "Compliance"
  },
  {
   "slug": "approval-quality-framework",
   "title": "Just-in-time privilege",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/SoD%20Exception%20Evidence/1200_630/blog.jpg",
 "wordcount": 923,
 "url": "/blog/sod-exception-evidence.html",
 "reading_time": "4 min read",
 "seo_title": "Segregation of duties exceptions and compensation",
 "meta_description": "An SoD conflict is accepted because the business needs it. The register records an approver, a date and a free-text compensating control.",
 "hub": {
  "slug": "topics/access-governance",
  "title": "Access governance and certification"
 },
 "answer": "Frequently nothing testable. A segregation of duties conflict is accepted because the business needs it, and the register records an approver, a date and a free-text compensating control. Whether that control ever operated is not recorded anywhere.",
 "answer_q": "What does a compensating control actually compensate for?",
 "glossary": [
  {
   "term": "Segregation of duties",
   "def": "Splitting a sensitive process so no single person can complete it alone."
  },
  {
   "term": "Compensating control",
   "def": "An alternative measure accepted where segregation is impractical — and frequently unverified."
  },
  {
   "term": "Exception register",
   "def": "The record of accepted conflicts, which in most organisations grows and is rarely pruned."
  }
 ],
 "checklist": {
  "title": "Making exceptions evidential",
  "id": "exceptions",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Require a named owner and a frequency.",
    "text": "A control without either is a sentence."
   },
   {
    "name": "Require evidence of operation.",
    "text": "Per period, not per policy."
   },
   {
    "name": "Sign the acceptance, with the mitigation stated.",
    "text": "So the approver owns what they accepted."
   },
   {
    "name": "Expire exceptions by default.",
    "text": "Renewal should be a decision, not an inheritance."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav turns an access decision into an artefact: what the reviewer was shown, who they were, what authority they held, signed and verifiable by an auditor without your systems.",
  "href": "../docs.html",
  "label": "See review receipts"
 }
}