Mathematical Formulation of the Effectiveness of “Separation of Duties” as a Preventive Control Activity

Abstract

ABSTRACT We contribute to the literature by examining, for the first time, degrees of separation of duties and ask whether SOD is an effective preventive control. We develop a mathematical model of the theoretical number of organizational fraud incidents, with and without SOD. We find that SOD results in the same or increased possibilities of fraud, relative to a lack of SOD, and that SOD needs to prevent 99 percent of frauds to always be an effective preventive control. Moreover, SOD's effectiveness is impaired by collusion. We suspect, however, that while acknowledging this impairment most people disregard or assign a low probability to collusion. We find that even when we assign low probabilities, the sheer number of possible collusive engagements weakens SOD as an effective preventive control. We illustrate our results with evidence provided by the Association for Certified Fraud Examiners (ACFE).