{"id":429,"date":"2026-01-27T21:31:14","date_gmt":"2026-01-27T20:31:14","guid":{"rendered":"https:\/\/valanconsulting.com\/preprod\/?page_id=429"},"modified":"2026-01-27T21:40:57","modified_gmt":"2026-01-27T20:40:57","slug":"when-trust-replaces-controls","status":"publish","type":"page","link":"https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/","title":{"rendered":"When trust replaces controls"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Why every business should think seriously about segregation of duties<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before getting into what segregation of duties (SoD) is and how organisations should approach it, it\u2019s worth briefly revisiting a story that illustrates how control failures tend to emerge \u2014 quietly, gradually, and often without malicious intent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Collins Street Bakery&nbsp;was a long-established business with more than a century of history and a strong culture of trust. Sandy Jenkins, the company\u2019s accountant, was given broad responsibility across the organisation\u2019s finances. What began as small misuse of petty cash gradually escalated into cheque fraud and unauthorised payments. Over a period of nine years, Jenkins embezzled more than $16 million before the activity was finally uncovered.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fraud persisted for so long not because the company lacked integrity, but because trust had quietly replaced basic controls. One individual had end-to-end responsibility for financial activities \u2014 including investigating why the company was losing money. It was only when a new joiner in the accounting team began questioning transactions that didn\u2019t make sense that the scale of the fraud came to light.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The full story is available here:<br><a href=\"https:\/\/collinstreet.com\/blogs\/stories\/the-sandy-jenkins-embezzlement-scandal\">https:\/\/collinstreet.com\/blogs\/stories\/the-sandy-jenkins-embezzlement-scandal<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most public companies are familiar with the need for financial controls, but smaller or privately owned organisations often operate more informally. Trust replaces structure, and controls are assumed to be unnecessary. This is precisely the environment in which opportunity is created \u2014 and where motivated individuals can exploit it for long periods without detection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s also worth noting that motivation is rarely as simple as greed. In some cases it is, but more often it reflects personal pressure, perceived entitlement, financial stress, or the gradual normalisation of behaviour that initially felt minor or justified. Most control failures are not driven by overtly malicious intent, but by situations where opportunity, motivation, and insufficient oversight quietly align over time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is where segregation of duties comes in.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SoD is not a technical concept; it arises from a simple risk assessment. The question being asked is:&nbsp;<em>what combinations of responsibility, if held by a single individual, create an unacceptable level of risk?<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, allowing the same person to manage suppliers, change bank account details, and process invoices or payments creates a clear opportunity for abuse. It\u2019s often argued that suppliers would quickly notice something was wrong, but the key point is that the opportunity exists \u2014 and where opportunity exists, motivated individuals will find ways to exploit it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">From this assessment, rules are established. A simple one might be that the same individual cannot both manage suppliers and process payments. This is the essence of SoD. Defining these rules takes time, and implementing them \u2014 particularly in ERP systems \u2014 can be effort-intensive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unsurprisingly, businesses often perceive SoD as friction. There will be resistance. In some cases, legitimate operational constraints mean SoD cannot be fully maintained. Where that happens, mitigating controls must be designed and formally reviewed to ensure the risk remains understood and controlled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Another common source of resistance comes from so-called \u201csuper users\u201d. These are individuals who argue they need broad access because they support others, resolve issues, or understand the system better than anyone else. Support teams often make similar arguments:&nbsp;<em>we can\u2019t help unless we can see and do everything<\/em>. These justifications frequently go unchallenged because they sound reasonable \u2014 or because challenging them feels like too much effort.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For CIOs and those responsible for ERP programmes, these are exactly the issues that need to be addressed early. Designing segregation of duties and control frameworks from the outset makes business acceptance easier, reduces downstream remediation, and significantly smooths post-deployment audit scrutiny. Most importantly, it demonstrates that both IT and the business have a clear, shared understanding of the risks they are managing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Most control failures aren\u2019t the result of bad intent, but of good people operating in systems that allow risk to accumulate quietly over time.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Why every business should think seriously about segregation of duties Before getting into what segregation of duties (SoD) is and [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":427,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-429","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>When trust replaces controls - Valan Consulting<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"When trust replaces controls - Valan Consulting\" \/>\n<meta property=\"og:description\" content=\"Why every business should think seriously about segregation of duties Before getting into what segregation of duties (SoD) is and [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/\" \/>\n<meta property=\"og:site_name\" content=\"Valan Consulting\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-27T20:40:57+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/perspectives\\\/when-trust-replaces-controls\\\/\",\"url\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/perspectives\\\/when-trust-replaces-controls\\\/\",\"name\":\"When trust replaces controls - Valan Consulting\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/#website\"},\"datePublished\":\"2026-01-27T20:31:14+00:00\",\"dateModified\":\"2026-01-27T20:40:57+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/perspectives\\\/when-trust-replaces-controls\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/perspectives\\\/when-trust-replaces-controls\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/perspectives\\\/when-trust-replaces-controls\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Perspectives\",\"item\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/perspectives\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"When trust replaces controls\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/#website\",\"url\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/\",\"name\":\"VALAN Consulting\",\"description\":\"Oracle Fusion Cloud programme delivery\",\"publisher\":{\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/#organization\",\"name\":\"VALAN Consulting\",\"url\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/cropped-valan-logo-light.png\",\"contentUrl\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/wp-content\\\/uploads\\\/2026\\\/01\\\/cropped-valan-logo-light.png\",\"width\":240,\"height\":45,\"caption\":\"VALAN Consulting\"},\"image\":{\"@id\":\"https:\\\/\\\/valanconsulting.com\\\/preprod\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"When trust replaces controls - Valan Consulting","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_GB","og_type":"article","og_title":"When trust replaces controls - Valan Consulting","og_description":"Why every business should think seriously about segregation of duties Before getting into what segregation of duties (SoD) is and [&hellip;]","og_url":"https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/","og_site_name":"Valan Consulting","article_modified_time":"2026-01-27T20:40:57+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/","url":"https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/","name":"When trust replaces controls - Valan Consulting","isPartOf":{"@id":"https:\/\/valanconsulting.com\/preprod\/#website"},"datePublished":"2026-01-27T20:31:14+00:00","dateModified":"2026-01-27T20:40:57+00:00","breadcrumb":{"@id":"https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/valanconsulting.com\/preprod\/perspectives\/when-trust-replaces-controls\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/valanconsulting.com\/preprod\/"},{"@type":"ListItem","position":2,"name":"Perspectives","item":"https:\/\/valanconsulting.com\/preprod\/perspectives\/"},{"@type":"ListItem","position":3,"name":"When trust replaces controls"}]},{"@type":"WebSite","@id":"https:\/\/valanconsulting.com\/preprod\/#website","url":"https:\/\/valanconsulting.com\/preprod\/","name":"VALAN Consulting","description":"Oracle Fusion Cloud programme delivery","publisher":{"@id":"https:\/\/valanconsulting.com\/preprod\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/valanconsulting.com\/preprod\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/valanconsulting.com\/preprod\/#organization","name":"VALAN Consulting","url":"https:\/\/valanconsulting.com\/preprod\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/valanconsulting.com\/preprod\/#\/schema\/logo\/image\/","url":"https:\/\/valanconsulting.com\/preprod\/wp-content\/uploads\/2026\/01\/cropped-valan-logo-light.png","contentUrl":"https:\/\/valanconsulting.com\/preprod\/wp-content\/uploads\/2026\/01\/cropped-valan-logo-light.png","width":240,"height":45,"caption":"VALAN Consulting"},"image":{"@id":"https:\/\/valanconsulting.com\/preprod\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/pages\/429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/comments?post=429"}],"version-history":[{"count":2,"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/pages\/429\/revisions"}],"predecessor-version":[{"id":433,"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/pages\/429\/revisions\/433"}],"up":[{"embeddable":true,"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/pages\/427"}],"wp:attachment":[{"href":"https:\/\/valanconsulting.com\/preprod\/wp-json\/wp\/v2\/media?parent=429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}