A Second Look at a Mathematical Formulation of the Effectiveness of “Separation of Duties” as a Preventative Control Activity

Barra, Savage, and Im (2020) provide a mathematical model showing separation of duties (SOD) increases fraud, contradicting widespread and long-held beliefs. This paper argues that Barra et al.’s (2020) controversial conclusion relies on unrealistic assumptions. In particular, we object to the assumption that any randomly formed collusion group of the right size can commit fraud. Instead, we argue that a group can only commit fraud if it controls the duties of authorization, record-keeping, and custody of assets. In addition, we argue that assigning equal probabilities to outcomes assumes away the very feature of SOD that decreases fraud risk; namely, SOD adds a point of failure by requiring the fraudster to recruit other employees. We nevertheless show that SOD can increase fraud risk when its implementation requires hiring many new employees. However, other controls can be combined synergistically with SOD to restore its fraud-decreasing ability.