Separation of concerns

Segregation of duties

Six duty pairs that should not sit in one pair of hands. more

Health

Whether incompatible duties are separated

Segregation rules in force, the conflicts detected against them and how many have been mitigated.

This is the finding, not a decoration. 291 of 385 conflicts have no named owner and no remediation date. Detection is working; triage is not keeping up with it. That gap is carried as an open exception on CTL-005.

The duty pairs

What each rule separates, how it is enforced, and how many holders it currently finds.

SOD-01Raise and approve the same item

Raise a request or a work itemagainstApprove, escalate or clear that same item

CriticalBlocking

The oldest control in existence. more

When it is breached: The decision interface refuses the action, names the rule, and writes a refusal record to the evidence spine under the requester identity.

detected live

on the books

unowned

mitigated

SOD-02Own a station and clear its own gate

Own the station that produces the workagainstApprove the gate that checks that station

HighDetective

A gate approved by the person who owns the work upstream of it is a formality. more

When it is breached: Detected and listed. Not blocked, because in many small functions there is genuinely nobody else — the compensating control is that the conflict is named and owned.

153

detected live

153

on the books

122

unowned

mitigated

SOD-03Approve a policy and clear the gate it governs

Approve the policy itemagainstApprove a gate on a line the policy binds

HighDetective

Writing the rule and then judging compliance with it collapses two independent checks into one opinion.

When it is breached: Detected and listed with the policy reference and the gate that is affected.

153

detected live

153

on the books

120

unowned

mitigated

SOD-04Own an agent and attest its own rating

Own the sub-function whose agents are being changedagainstStand behind the estate rating that grades those agents

HighDetective

A rating signed by the person whose numbers it grades is a self-assessment. more

When it is breached: Detected and listed. Independent re-rating is the remediation, not removal of the owner.

detected live

on the books

unowned

mitigated

SOD-05Delegate authority to oneself

Act as the delegator on an authority grantagainstHold the grant that was delegated

CriticalDetective

Self-delegation makes the authority register circular. more

When it is breached: Detected and listed. A self-delegated grant should be revoked and re-issued by the level above.

detected live

on the books

unowned

mitigated

No holder of this pair anywhere in the estate. Reported as zero because it is zero, not because the rule is switched off.

SOD-06Own a control and perform its own test

Own the controlagainstPerform the test that decides whether the control works

MediumDetective

This is the difference between "we have gates" and "the gates were tested by someone who does not run them".

When it is breached: Detected and listed. The test result is retained but is marked as not independent.

detected live

on the books

unowned

mitigated

Who holds both sides most often

Concentration matters more than the raw count. more

VP Revenue Growth Management5

Director, Legal Operations5

Director, Demand Development3

Director, Sales Enablement3

Director, Sales Compensation3

Director, Market Intelligence3

VP Demand Generation3

Director, Content3

Conflict register

22 matching, showing up to 120

Ruleall SOD-01 SOD-02 SOD-03 SOD-04 SOD-05 SOD-06Stateall Detected, unowned In remediation Mitigated

Filtered to procurement · clear

Reference	Holder	Where	Both sides	Owner and fix	State
SOD-02-9E152C90SOD-02	VP Category ManagementStation owner and gate approver	Procurement & Source-to-PayCategory Strategy	A. Owns 3 stations on line PR1B B. Approves the same 3 gates: Ratify, Leader review, Council ratify	No owner assigned	Detected, unowned
SOD-02-8418FC40SOD-02	Director, Procurement AnalyticsStation owner and gate approver	Procurement & Source-to-PaySpend Analytics	A. Owns 3 stations on line PR2B B. Approves the same 3 gates: Escalate repeat, Leader review, Flag unclassified	No owner assigned	Detected, unowned
SOD-02-7A590ABASOD-02	Director, Strategic SourcingStation owner and gate approver	Procurement & Source-to-PaySourcing & RFx	A. Owns 4 stations on line PR3A B. Approves the same 4 gates: Award decision, Approve scope, Escalate and others	No owner assigned	Detected, unowned
SOD-02-F983C7A6SOD-02	VP SourcingStation owner and gate approver	Procurement & Source-to-PayNegotiation & Award	A. Owns 4 stations on line PR4B B. Approves the same 4 gates: Approve, Set walk-away, Award and others	No owner assigned	Detected, unowned
SOD-02-AAAE9795SOD-02	Director, Contract ManagementStation owner and gate approver	Procurement & Source-to-PayContract Execution	A. Owns 5 stations on line PR5B B. Approves the same 5 gates: Approve, Legal check, Owner decision and others	No owner assigned	Detected, unowned
SOD-02-C0F82070SOD-02	Director, Supplier ManagementStation owner and gate approver	Procurement & Source-to-PaySupplier Onboarding	A. Owns 4 stations on line PR6A B. Approves the same 4 gates: Approve, Verify bank details, Approve and others	No owner assigned	Detected, unowned
SOD-02-5EE0AA39SOD-02	Director, Supplier RiskStation owner and gate approver	Procurement & Source-to-PaySupplier Performance & Risk	A. Owns 4 stations on line PR7C B. Approves the same 4 gates: Legal review, Leadership approve, Alert owner and others	No owner assigned	Detected, unowned
SOD-02-A7670EFFSOD-02	Director, Procurement OperationsStation owner and gate approver	Procurement & Source-to-PayRequisition & PO	A. Owns 3 stations on line PR8B B. Approves the same 3 gates: Approve, Approve above threshold, Route approval	No owner assigned	Detected, unowned
SOD-02-EEC3E105SOD-02	Director, Accounts Payable OperationsStation owner and gate approver	Procurement & Source-to-PayInvoice & Three-Way Match	A. Owns 4 stations on line PR9A B. Approves the same 4 gates: Resolve, Release or reject, Analyst review and others	No owner assigned	Detected, unowned
SOD-02-59EF9C65SOD-02	Director, Payment OperationsStation owner and gate approver	Procurement & Source-to-PayPayment Interlock	A. Owns 4 stations on line PR10B B. Approves the same 4 gates: Dual approve, Treasury check, Approve run and others	No owner assigned	Detected, unowned
SOD-03-D0B6FB89SOD-03	Director, Procurement AnalyticsPolicy approver and gate approver	Procurement & Source-to-PaySpend Analytics	A. Approved 3 policy items: PR2-POL-200, PR2-POL-202, PR2-POL-201 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-8D0E3E1FSOD-03	Director, Strategic SourcingPolicy approver and gate approver	Procurement & Source-to-PaySourcing & RFx	A. Approved 2 policy items: PR3-POL-201, PR3-POL-200 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-C91FE5FFSOD-03	VP SourcingPolicy approver and gate approver	Procurement & Source-to-PayNegotiation & Award	A. Approved 3 policy items: PR4-POL-201, PR4-POL-202, PR4-POL-200 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-824C3AFESOD-03	Director, Contract ManagementPolicy approver and gate approver	Procurement & Source-to-PayContract Execution	A. Approved 4 policy items: PR5-POL-202, PR5-POL-201, PR5-POL-200, PR5-POL-203 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-25187FFDSOD-03	Director, Supplier ManagementPolicy approver and gate approver	Procurement & Source-to-PaySupplier Onboarding	A. Approved 4 policy items: PR6-POL-202, PR6-POL-201, PR6-POL-200, PR6-POL-203 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-D988A8D4SOD-03	Director, Supplier RiskPolicy approver and gate approver	Procurement & Source-to-PaySupplier Performance & Risk	A. Approved 4 policy items: PR7-POL-203, PR7-POL-200, PR7-POL-202, PR7-POL-201 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-E7DEDEF6SOD-03	Director, Procurement OperationsPolicy approver and gate approver	Procurement & Source-to-PayRequisition & PO	A. Approved 3 policy items: PR8-POL-200, PR8-POL-201, PR8-POL-202 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-3C070134SOD-03	Director, Accounts Payable OperationsPolicy approver and gate approver	Procurement & Source-to-PayInvoice & Three-Way Match	A. Approved 3 policy items: PR9-POL-200, PR9-POL-201, PR9-POL-202 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-34A39092SOD-03	Director, Payment OperationsPolicy approver and gate approver	Procurement & Source-to-PayPayment Interlock	A. Approved 4 policy items: PR10-POL-200, PR10-POL-203, PR10-POL-201, PR10-POL-202 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-03-3BC15851SOD-03	Director, Value AssurancePolicy approver and gate approver	Procurement & Source-to-PaySavings Assurance	A. Approved 2 policy items: PR11-POL-200, PR11-POL-201 B. Also approves gates on the lines those policies bind	No owner assigned	Detected, unowned
SOD-04-280789F4SOD-04	Director, Procurement AnalyticsSub-function owner and rating attester	Procurement & Source-to-PaySpend Analytics	A. Owns 8 agents running at autonomy level 93 B. Stands behind the A estate rating that grades those same agents	No owner assigned	Detected, unowned
SOD-04-B3F6BD8FSOD-04	Director, Supplier ManagementSub-function owner and rating attester	Procurement & Source-to-PaySupplier Onboarding	A. Owns 8 agents running at autonomy level 78 B. Stands behind the A estate rating that grades those same agents	No owner assigned	Detected, unowned

Actions

What is waiting on a person

A separation rule is only real when somebody unwinds the combinations it forbids. more

291

Start unwinding a detected conflict

Found by the rule and nobody has picked it up.

Finish a remediation already underway

Owner named, plan written, not yet closed.

Escalate a conflict past its date

Past the remediation date on the record and still combining both duties.

Decide whether a detective rule should block

These rules report a conflict after the fact instead of preventing it.

Operations

What this desk is allowed to start

A surface that only reports is not operable. more

Trigger and bound

This desk can raise, reassign or mitigate a conflict, and it can change a rule between detective and blocking. more

Live observability

What the record shows right now

Conflict states across the estate. more

Current distribution

385 conflicts

Detected, untouched29176%

In remediation6016%

Mitigated349%

Is policy and strategy coming to fruition

Whether the written intent is holding here

351 live conflicts against 6 written rules, and 5 of those rules cannot stop anything.

Not holding on the record

The written position is that no single holder should be able to both initiate and approve the same class of commitment. more

How to read this honestly

One rule is blocking and five are detective. SOD-01 is refused at the decision interface — the person who raised a work item cannot approve it, the attempt fails with the rule named, and a refusal record is written to the evidence spine. The other five are found and listed but not prevented, because in a sub-function with one senior person there is genuinely nobody else to hold the second duty. Naming the conflict and giving it an owner is the compensating control, and 291 of them do not have one yet.

The live detector and the standing register are computed by the same code, so they cannot drift apart. 4 conflicts are visible to the detector but have never been triaged onto the register. 4 rows on the register are no longer found in the estate and can be closed.