Segregation of Duties Review within Financial and HR System
Updated: 5 hours ago
Start Date: 9/24/24
Why the Office of the CIty Auditor (OCA) did this project
Office of the City Auditor (OCA’s) data analytics include a component that shows trends in financial risks. The analysis compares each financial module’s risk relative to the other financial modules. This provides information to help choose which financial module to focus on for a deeper analysis of risk indicators. OCA chose the Segregation of Duties (SOD) module for review because it had a large number of flags that had not been previously reviewed. Segregation of duties is a key internal control because it prevents fraud, errors, and conflicts of interest by ensuring that no single person has complete control over a critical process, effectively dividing responsibilities among different individuals and minimizing the risk of unauthorized activities or misuse of assets.
Project Scope
This is a review of analytics with flagged data that is deemed high risk in the Segregation of Duties module as of May 2026.
About this Audit
Focus of the Audit
Examines the City's enforcement of segregation of duties in financial and Human Resources systems to prevent fraud and errors, ensure compliance, maintain accountability, and protect organization integrity.
Why audit this topic?
The office of the City Auditor's data analytics include a component that shows trends in financial risks. The analysis compares each financial module's risk relative to the other financial modules. This provides information to help choose which financial module to focus on for a deeper analysis of risk indicators.
Project Procedures
Refer to “Best Practices to Resolve Segregation of Duties Conflicts” from ISACA, the Information Systems Audit and Control Association, to determine analytics for high-risk conflicting permissions.
Review the City’s financial system permissions and match to ISACA high risk permissions where applicable.
Review each user’s combined permissions from all their assigned roles to identify conflicting permissions.
Following review of all permission definitions, meet with functional area leads to determine where workflows are in place providing controls for these high-risk permissions.
Key Observations
OCA compared permissions within the City’s financial system to 43 high-risk conflict combinations and reviewed all identified conflicts.
All conflict pairs were provided to Finance and Enterprise System Management departments in accordance with City of Tulsa Executive Order 2004-01.
Executive Order 2004-01 is an information protection protocol developed to safeguard vulnerability assessments, security plans and any information derived from them.
The City Auditor’s 2028 audit plan will include a follow up segregation of duties audit on the financial system.
Audit Objective
Review high-risk permission conflict combinations in the Segregation of Duties module.
Procedures
Project procedures included a review of all financial system’s permissions to permissions ISACA identified as high-risk conflicting permissions:
Accounts Payable Payments & Bank Reconciliation - Permissions allow the possibility of entering unauthorized payments and reconciling with the bank through the same person.
Process Checks & Bank Reconciliation - Permissions allow the possibility of entering unauthorized manual payments and reconciling with the bank through the same person.
Number Ranges & Accounts Payable Payments - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Asset Document - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Asset Master - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Cash - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Customer Data - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Customer Invoices - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Journal Entries - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Process Checks - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Number Ranges & Vendor Master - Permissions allow the possibility of AP, AR, GL master data creation and posting functions in conjunction with payment processing, receipt of money, GL account access; and the ability to modify ECCS hierarchy and reporting output.
Cash & Bank Reconciliation - Permissions allow the possibility for differences between cash deposited and cash collections posted to be covered up.
Maintain Projects & Settle Projects - Permissions allow the possibility for a user to use a fictitious project to allocate overages of an actual project, and settle the project without going through the settlement approval process.
Number Ranges & System Administration - Permissions allow the possibility for a user to reset the number ranges and delete the log, audit trail.
Approve Purchase Orders & Process Invoices - Permissions allow the possibility for a user to release a non bona-fide purchase order and initiate payment for the order by entering invoices.
Maintain Time & Process Payroll - Permissions allow the possibility for a user to modify time data and process payroll resulting in fraudulent payments.
Employee Master & Process Payroll - Permissions allow the possibility for a user to modify payroll master data and then process payroll.
Basic Table & System Administration - Permissions allow the possibility for a user to modify data in tables or modify valid configuration values and set up the production environment to run transactions and programs using the inappropriately modified data.
Maintain Projects & Process Overhead - Permissions allow the possibility for a user to manipulate the work breakdown structure elements (profit centers, business areas, cost centers, plants) and post overhead expenses to the project.
Maintain Purchase Orders & Approve Purchase Orders - Permissions allow the possibility for a user to maintain a purchase order and release or approve it.
Bank Master & Cash - Permissions allow the possibility for a user to maintain a non bona-fide bank account and divert incoming payments to it.
Accounts Payable Payments & Vendor Master - Permissions allow the possibility for a user to maintain a fictitious vendor and create a payment to that vendor.
Process Checks & Vendor Master - Permissions allow the possibility for a user to maintain a fictitious vendor and create a payment to that vendor.
Maintain Purchase Orders & Goods Receiving - Permissions allow the possibility for a user to enter fictitious purchase orders for personal use and accept the goods through goods receipt.
Approve Purchase Orders & Accounts Payable Payments - Permissions allow the possibility for a user to enter a fictitious purchase order and enter the covering payment.
Maintain Purchase Orders & Accounts Payable Payments - Permissions allow the possibility for a user to enter a fictitious purchase order and enter the covering payment.
Maintain Purchase Orders & Process Checks - Permissions allow the possibility for a user to enter a fictitious purchase order and enter the covering payment.
Asset Master & Goods Receiving - Permissions allow the possibility for a user to create the asset and manipulate the receipt of the associated asset.
Create Contracts & Approve Contracts - Permissions allow the possibility for a user to create and approve their own contracts.
Asset Document & Goods Receiving - Permissions allow the possibility for a user to create an invoice through ERS goods receipt and hide it in an asset that would be depreciated over time.
Bank Master & Process Checks - Permissions allow the possibility for a user to create a non bona-fide bank account and create manual checks from it.
Bank Master & Accounts Payable Payments - Permissions allow the possibility for a user to create a non bona-fide bank account and create a check from it.
Approve Purchase Orders & Vendor Master - Permissions allow the possibility for a user to create a fictitious vendor or change existing vendor master data and approve purchases to this vendor.
Vendor Master & Maintain Purchase Orders - Permissions allow the possibility for a user to create a fictitious vendor and initiate purchases to that vendor.
Approve Purchase Orders & Process Checks - Permissions allow the possibility for a user to commit the company to fraudulent purchases and initiate manual check payments for unauthorized goods and services.
Maintain Time & Approve Time - Permissions allow the possibility for a user to change payroll master data and enter time data applied to incorrect settings.
Configure Payroll & Maintain Payroll - Permissions allow the possibility for a user to change payroll configuration and perform maintenance on payroll settings.
Configure Payroll & Process Payroll - Permissions allow the possibility for a user to change payroll configuration and perform maintenance on payroll settings.
Employee Master & Maintain Payroll - Permissions allow the possibility for a user to change payroll and process payroll without proper authorization.
Maintain Payroll & Process Payroll - Permissions allow the possibility for a user to change payroll and process payroll without proper authorization.
HR Benefits & Process Payroll - Permissions allow the possibility for a user to change employee HR benefits then process payroll without authorization.
Employee Master & Configure Payroll - Permissions allow the possibility for a user to change configuration of payroll then modify payroll master data resulting in fraudulent payments.
Approve Purchase Orders & Goods Receiving - Permissions allow the possibility for a user to approve the purchase of unauthorized goods and hide the misuse of inventory by not fully receiving the order.
Results
Internal Audit reviewed each of these high-risk permission pairs where conflicts were flagged. The exceptions were reported to management but will not be specified in this report in accordance with Executive Order 2004-01, which is an information protocol developed to safeguard vulnerability assessments, security plans and any information derived from them. The City Auditor’s 2028 audit plan will include a follow up segregation of duties audit on the financial system.