User Access and Segregation of Duties: law, practical example, evidence, risk and Finin2min action workflow.
Access should match role, be approved, reviewed and promptly removed.
IT general controls
Read with the current rules, notifications, circulars, portal instructions and binding judgments applicable to the event date.
Fix person, entity, role, activity, period, location, threshold and regulator.
Separate statute, delegated law, regulator guidance, contract and internal policy.
Reconcile documents, systems, filings, accounts and approvals.
Run periodic SoD analytics.
A user can create vendors and release payments.
Finin2min decision rule: reperform the analysis when a material fact, date, role or legal instrument changes.
Conflicting rights create fraud opportunity.
Common additional failures are stale law, incomplete authority, inconsistent records, undocumented judgment and missing cross-law analysis.
| Stage | Control | Output |
|---|---|---|
| Facts | Freeze parties, dates, amounts and documents | Fact sheet |
| Law | Open current primary sources | Legal map |
| Evidence | Resolve inconsistencies | Evidence index |
| Decision | Approve, remediate, disclose or escalate | Signed note |
Access should match role, be approved, reviewed and promptly removed.
IT general controls
process narrative and control matrix; master and access reports; reconciliations and exception logs; system audit trail.
Run periodic SoD analytics.
Source review: 4 July 2026. Verify later amendments and case status before professional reliance.