Separation of duties (SoD) means no single person should be able to complete every step of a financial process on their own. When one person holds two roles that together let them start and finish the same transaction, there is a risk of fraud or error that nobody would catch. SoD controls prevent that by keeping incompatible roles with different people.

A simple example

If one person can enter a supplier invoice and create the payment for it, they could pay an invoice that should never have been approved. Splitting those two steps between two people means each step is checked by someone else.

Step 1

Enter the supplier invoice

Person A

Step 2

Create the payment

Person B

How SoD affects an access request

  • Conflicts are checked at the role level.

    It does not matter which FRUs or projects the roles apply to. If a person holds, or is requesting, two roles that conflict, we flag it.

  • It applies across systems.

    OFC, Jaggaer, Concur and TOE roles are all considered.

  • The request is paused, not denied.

    We note the conflict on the ticket and ask which role the person should keep. We allow up to 3 business days for a reply before the request is closed.

Tip: Before you submit, compare the roles you plan to request, including any the person already has, against the lists below. If two roles conflict, decide which one the person needs most, or have a second person take on the other duty.

Common conflicts in Oracle Financial Cloud (OFC)

OFC checks combinations of functions grouped by business process. These are the kinds of pairings that cannot be held by the same person.

Business processFunctions that cannot be combinedWhat could go wrong
Procure to Pay
  • Enter AP invoices and enter payments
  • Enter AP invoices and set up Payables
  • Enter purchase orders and enter AP invoices
  • Create suppliers and enter purchase orders, invoices or payments
A person could create a fictitious supplier, purchase or invoice and pay it.
Invoice to Cash
  • Enter AR invoices and open or close AR periods
  • Enter AR invoices and set up Receivables
  • Create customers and enter AR invoices
  • Enter journals and enter cash receipts
A person could inflate revenue, post into a closed period or hide a manipulated receipt.
Projects and Grants
  • Enter project costs and capitalize projects
  • Enter project costs and create project invoices
A person could inflate asset values or project revenue.
Record to Report
  • Enter journals and post journals
  • Enter journals and open or close GL periods
  • Enter journals and set up the General Ledger
  • Reconcile cash and enter payments or cash receipts
  • Perform cash transactions and set up Cash Management
A person could post unreviewed entries, change a closed period or manipulate the cash position.
Information Technology
  • System administration or setup and business transactions
A person could change configuration and then process transactions that rely on it. In practice, roles with "Setup" in the name and transactional roles are not combined without additional review.

Jaggaer role combinations that cannot be held together

Jaggaer conflicts are listed in the Gateway Roles Matrix (Google Sheet, opens in a new tab). In summary:

Jaggaer roleCannot be combined with
Requestor
  • FRU Approver (LV1 to LV4)
  • Project Analyst
Department Analyst
  • FRU Approver (LV1 to LV4)
  • Project Analyst
  • Project Manager
FRU Approver (LV1 to LV4)
  • Requestor
  • Department Analyst
  • Flexcard Holder
Allocator
  • Project Analyst
  • Department Invoice Approver
Department Invoice Approver
  • Allocator
  • Flexcard Holder
Department Flexcard Administrator
  • Flexcard Holder
Flexcard Holder
  • FRU Approver (LV1 to LV4)
  • Department Invoice Approver
  • Department Flexcard Administrator
  • Project Analyst
Project Analyst
  • Requestor
  • Department Analyst
  • Allocator
  • Flexcard Holder
Project Manager
  • Department Analyst
Advanced ShopperAny other Jaggaer role

The Flexcard Holder combinations matter most because they would let a person approve their own FlexCard purchases.