Internal Controls
SoD Mitigation Control Coverage
Counting SoD conflicts backed by an effective compensating control.
Knowing which duty conflicts are genuinely compensated
Segregation of duties cannot always be achieved in small public-sector teams, so the real question is whether each unavoidable conflict is backed by an effective compensating control. An uncompensated SoD conflict is an open door to error and fraud that the AGSA and internal audit will flag without hesitation. AuditPro Core shows how many SoD conflicts are actually covered by an effective mitigation, separating managed risk from naked exposure.
The Numbers
AuditPro Core renders this view from your tenant's live, tamper-evident records. The figures below are illustrative sample data.
Accepted conflicts
64
Mitigation in place
47
73%
Mitigation untested
12
Mitigation failing
5
false comfort
Conflicts by mitigation status
Mitigation quality by conflict rule
| Conflict rule | Compensating control | Tested | Verdict |
|---|---|---|---|
| Create & approve PO | Monthly spend review | Yes | Effective |
| Maintain vendor & pay | Master-data log review | No | Untested |
| Post & approve JE | Independent JE review | Yes | Failing |
| Hire & set pay | HR exception report | Yes | Effective |
| Receive & record asset | Asset count | No | Untested |
Figures shown are illustrative sample data for demonstration. AuditPro Core renders these views from your own tenant's live, tamper-evident records.
Why conflicts persist
In lean structures one person often must both initiate and approve, creating an unavoidable conflict. The mature response is not to deny it but to compensate for it explicitly.
Compensating controls
A compensating control such as independent review of exception reports reduces the risk that the conflict will be abused. To count, it must specifically address that conflict, not merely exist nearby.
Effectiveness, not existence
A compensating control that is never performed offers no protection. Coverage must be measured on whether the mitigation actually operates effectively, not whether it is documented.
Residual conflict list
The conflicts with no effective mitigation are the genuine exposure. This shortlist is what oversight should focus on rather than the full conflict population.
How AuditPro Core Bridges the Gap
- Conflict-to-mitigation mapping: each SoD conflict links to the specific compensating control intended to cover it.
- Effectiveness gating: only mitigations assessed as operating effectively count as coverage, avoiding paper protection.
- Exception workflow: uncompensated or weakly compensated conflicts raise an action for the control owner.
- Audit-ready export: the coverage position evidences how unavoidable conflicts are managed for AGSA review.
Key Takeaways
- Unavoidable SoD conflicts must be explicitly compensated, not ignored.
- A compensating control must target the specific conflict to count.
- Measure coverage on effectiveness, not mere documentation.
- Focus oversight on the uncompensated conflict shortlist.
See This on Your Own Data
AuditPro Core renders this dashboard from your tenant's live, tamper-evident records — every figure traceable to source.