LensReading which lens this session carries.

Separation of concerns

Segregation of duties

Six duty pairs that should not sit in one pair of hands.

Health

Whether incompatible duties are separated

Segregation rules in force, the conflicts detected against them and how many have been mitigated.

This is the finding, not a decoration. 291 of 385 conflicts have no named owner and no remediation date. Detection is working; triage is not keeping up with it. That gap is carried as an open exception on CTL-005.

The duty pairs

What each rule separates, how it is enforced, and how many holders it currently finds.

SOD-01Raise and approve the same item
Raise a request or a work itemagainstApprove, escalate or clear that same item
CriticalBlocking

The oldest control in existence.

When it is breached: The decision interface refuses the action, names the rule, and writes a refusal record to the evidence spine under the requester identity.
8
detected live
8
on the books
0
unowned
4
mitigated
SOD-02Own a station and clear its own gate
Own the station that produces the workagainstApprove the gate that checks that station
HighDetective

A gate approved by the person who owns the work upstream of it is a formality.

When it is breached: Detected and listed. Not blocked, because in many small functions there is genuinely nobody else — the compensating control is that the conflict is named and owned.
153
detected live
153
on the books
122
unowned
13
mitigated
SOD-03Approve a policy and clear the gate it governs
Approve the policy itemagainstApprove a gate on a line the policy binds
HighDetective

Writing the rule and then judging compliance with it collapses two independent checks into one opinion.

When it is breached: Detected and listed with the policy reference and the gate that is affected.
153
detected live
153
on the books
120
unowned
9
mitigated
SOD-04Own an agent and attest its own rating
Own the sub-function whose agents are being changedagainstStand behind the estate rating that grades those agents
HighDetective

A rating signed by the person whose numbers it grades is a self-assessment.

When it is breached: Detected and listed. Independent re-rating is the remediation, not removal of the owner.
69
detected live
69
on the books
49
unowned
8
mitigated
SOD-05Delegate authority to oneself
Act as the delegator on an authority grantagainstHold the grant that was delegated
CriticalDetective

Self-delegation makes the authority register circular.

When it is breached: Detected and listed. A self-delegated grant should be revoked and re-issued by the level above.
0
detected live
0
on the books
0
unowned
0
mitigated
No holder of this pair anywhere in the estate. Reported as zero because it is zero, not because the rule is switched off.
SOD-06Own a control and perform its own test
Own the controlagainstPerform the test that decides whether the control works
MediumDetective

This is the difference between "we have gates" and "the gates were tested by someone who does not run them".

When it is breached: Detected and listed. The test result is retained but is marked as not independent.
2
detected live
2
on the books
0
unowned
0
mitigated

Who holds both sides most often

Concentration matters more than the raw count.

VP Revenue Growth Management5
Director, Legal Operations5
Director, Demand Development3
Director, Sales Enablement3
Director, Sales Compensation3
Director, Market Intelligence3
VP Demand Generation3
Director, Content3

Conflict register

19 matching, showing up to 120

RuleallSOD-01SOD-02SOD-03SOD-04SOD-05SOD-06StateallDetected, unownedIn remediationMitigated
Filtered to revenue-operations · clear
ReferenceHolderWhereBoth sidesOwner and fixState
SOD-02-01214880SOD-02Director, Revenue DataStation owner and gate approverRevenue Growth ManagementCRM Data Stewardship
A. Owns 3 stations on line RO1B
B. Approves the same 3 gates: Approve, Steward review, Owner review
No owner assignedDetected, unowned
SOD-02-E6C330B1SOD-02VP PricingStation owner and gate approverRevenue Growth ManagementPricing & Rate Cards
A. Owns 4 stations on line RO2B
B. Approves the same 4 gates: Approve, Legal check, Pricing council approve and others
No owner assignedDetected, unowned
SOD-02-2DED8DDDSOD-02Director, Quote OperationsStation owner and gate approverRevenue Growth ManagementQuote-to-Order
A. Owns 3 stations on line RO3A
B. Approves the same 3 gates: Route approvals, Countersign, Approve
No owner assignedDetected, unowned
SOD-02-80CC5D2CSOD-02Director, Billing OperationsStation owner and gate approverRevenue Growth ManagementBilling Interlock
A. Owns 3 stations on line RO5A
B. Approves the same 3 gates: Exception hold, Flag material, Approve above threshold
No owner assignedDetected, unowned
SOD-02-5F213DDBSOD-02Director, Revenue AccountingStation owner and gate approverRevenue Growth ManagementRevenue Recognition Interlock
A. Owns 3 stations on line RO6B
B. Approves the same 3 gates: Controller approve, Controller sign, Controller review
No owner assignedDetected, unowned
SOD-02-B374BA21SOD-02Director, Renewal OperationsStation owner and gate approverRevenue Growth ManagementRenewals & Churn Ops
A. Owns 2 stations on line RO7B
B. Approves the same 2 gates: Save attempt, Leader review
No owner assignedDetected, unowned
SOD-02-5282F7D9SOD-02VP Revenue Growth ManagementStation owner and gate approverRevenue Growth ManagementForecast Integrity
A. Owns 2 stations on line RO9B
B. Approves the same 2 gates: Leader review, Leader readout
No owner assignedDetected, unowned
SOD-02-B3E2A8E9SOD-02Director, Revenue SystemsStation owner and gate approverRevenue Growth ManagementSystems & Integration
A. Owns 3 stations on line RO10B
B. Approves the same 3 gates: Change board approve, Escalate, Owner attest
No owner assignedDetected, unowned
SOD-02-EAA5221BSOD-02VP Revenue AnalyticsStation owner and gate approverRevenue Growth ManagementRevenue Analytics
A. Owns 4 stations on line RO11C
B. Approves the same 4 gates: Ratify, Finance review, Revenue chief sign and others
No owner assignedDetected, unowned
SOD-03-E17CE417SOD-03Director, Revenue DataPolicy approver and gate approverRevenue Growth ManagementCRM Data Stewardship
A. Approved 2 policy items: RO1-POL-201, RO1-POL-200
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-03-6422CF0ESOD-03Director, Order ManagementPolicy approver and gate approverRevenue Growth ManagementBooking & Order Management
A. Approved 2 policy items: RO4-POL-201, RO4-POL-200
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-03-F5BC58E5SOD-03Director, Billing OperationsPolicy approver and gate approverRevenue Growth ManagementBilling Interlock
A. Approved 2 policy items: RO5-POL-201, RO5-POL-200
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-03-3014ACE2SOD-03Director, Revenue AccountingPolicy approver and gate approverRevenue Growth ManagementRevenue Recognition Interlock
A. Approved 3 policy items: RO6-POL-201, RO6-POL-202, RO6-POL-200
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-03-4FE66BF6SOD-03Director, Renewal OperationsPolicy approver and gate approverRevenue Growth ManagementRenewals & Churn Ops
A. Approved 2 policy items: RO7-POL-201, RO7-POL-200
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-03-50E78AC2SOD-03Director, Sales OperationsPolicy approver and gate approverRevenue Growth ManagementTerritory & Comp Ops
A. Approved 2 policy items: RO8-POL-201, RO8-POL-200
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-03-5DF02636SOD-03Director, Revenue SystemsPolicy approver and gate approverRevenue Growth ManagementSystems & Integration
A. Approved 4 policy items: RO10-POL-202, RO10-POL-203, RO10-POL-200, RO10-POL-201
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-03-5791A58ASOD-03VP Revenue AnalyticsPolicy approver and gate approverRevenue Growth ManagementRevenue Analytics
A. Approved 4 policy items: RO11-POL-201, RO11-POL-200, RO11-POL-203, RO11-POL-202
B. Also approves gates on the lines those policies bind
No owner assignedDetected, unowned
SOD-04-FAF5A3CCSOD-04Director, Order ManagementSub-function owner and rating attesterRevenue Growth ManagementBooking & Order Management
A. Owns 8 agents running at autonomy level 82
B. Stands behind the A estate rating that grades those same agents
No owner assignedDetected, unowned
SOD-04-E99423EFSOD-04Director, Revenue SystemsSub-function owner and rating attesterRevenue Growth ManagementSystems & Integration
A. Owns 8 agents running at autonomy level 72
B. Stands behind the A estate rating that grades those same agents
No owner assignedDetected, unowned

Actions

What is waiting on a person

A separation rule is only real when somebody unwinds the combinations it forbids.

291

Start unwinding a detected conflict

Found by the rule and nobody has picked it up.

60

Finish a remediation already underway

Owner named, plan written, not yet closed.

60

Escalate a conflict past its date

Past the remediation date on the record and still combining both duties.

5

Decide whether a detective rule should block

These rules report a conflict after the fact instead of preventing it.

Operations

What this desk is allowed to start

A surface that only reports is not operable.

Trigger and bound

This desk can raise, reassign or mitigate a conflict, and it can change a rule between detective and blocking.

Live observability

What the record shows right now

Conflict states across the estate.

Current distribution

385 conflicts

Detected, untouched29176%
In remediation6016%
Mitigated349%

Is policy and strategy coming to fruition

Whether the written intent is holding here

351 live conflicts against 6 written rules, and 5 of those rules cannot stop anything.

Not holding on the record

The written position is that no single holder should be able to both initiate and approve the same class of commitment.

How to read this honestly

One rule is blocking and five are detective. SOD-01 is refused at the decision interface — the person who raised a work item cannot approve it, the attempt fails with the rule named, and a refusal record is written to the evidence spine. The other five are found and listed but not prevented, because in a sub-function with one senior person there is genuinely nobody else to hold the second duty. Naming the conflict and giving it an owner is the compensating control, and 291 of them do not have one yet.

The live detector and the standing register are computed by the same code, so they cannot drift apart. 4 conflicts are visible to the detector but have never been triaged onto the register. 4 rows on the register are no longer found in the estate and can be closed.