Why the conflicts are there
A segregation of duties conflict is rarely negligence. It is usually a small team where one person genuinely does raise the purchase order and approve the invoice, because there are only four people in finance and someone has to.
Treating those conflicts as failures to be eliminated produces a control design nobody can operate, which gets worked around, which is worse than the original conflict because now it is invisible.
Analysis is days, resolution is months
Running the analysis is fast. Modern platforms will produce the conflict matrix in a short engagement. That speed creates a false expectation that resolution is equally quick.
It is not, because each conflict needs a decision: split the duty and accept the operational cost, add a compensating control and document it, or accept the risk explicitly at the right level. Those are business decisions with business consequences, and they need a sponsor rather than a consultant.
A sequence that works
- Run the analysis and rank conflicts by actual exposure, not by count. A hundred low-value conflicts matter less than three that touch payments.
- For each high-exposure conflict, write down the operational reason it exists. If nobody knows, it is probably safe to close.
- Decide the treatment per conflict, with the operational cost stated. Splitting a duty in a four-person team has a real cost and someone senior should own that trade.
- Document accepted risks explicitly, at the level authorised to accept them. An undocumented accepted risk is an audit finding waiting to happen.
- Build the recurring access review as a scheduled process your team runs, not a project that gets repeated under pressure next year.
The part that gets skipped
Handover. A segregation of duties exercise that leaves your team unable to run the next access review has produced a snapshot, not a control. The deliverable is a process with an owner and a calendar entry, and the difference between that and a report is the difference between governance and a bottleneck with a name.