Separation of Duties (SOD)

SOD Conflicts

When setting up HRS access, you must maintain separation of duties (often referred to as "SOD") to the fullest extent possible. There are three main scenarios to avoid in users' HRS access to maintain separation of duties:

• HR1 - user's access would allow them to:
  • hire, update, or terminate employees and
  • create, edit, or approve timesheets
• HR2 - user's access would allow them to:
  • hire, update, or terminate employees and
  • create or update direct deposit information
• PY1 - user's access would allow them to:
  • hire, update, or terminate employees or approve timesheets and
  • create online checks or print or distribute paper checks

Sometimes conflicts are unavoidable based on a work unit's administrative structure. The goal is to minimize conflicts as much as possible so that users can't create SOD errors.

SOD Errors

When a user enters a combination of HRS transactions that match the SOD scenarios above, it creates an SOD error. If it is unavoidable for a user to have access that creates an SOD conflict, the work unit must review its business processes to make sure that users will not create SOD errors. For example, if a user has access to update job data and also supervises another employee, the work unit's business processes must include having someone else update job data or approve timesheets for the employee so that the user doesn't do both and create an SOD error. At least one person for each division has access to view reports of SOD errors in the HRS Workflow Exception Dashboard (WED). Divisions are responsible for checking the WED SOD reports at least once per week and investigating and resolving their SOD errors. If an error remains on a report for 14 days, OHR HRIS will email the division SOD reviewers to make sure the error is investigated and resolved as soon as possible.

SOD Error Resources

• Learn more about processing the WED SOD reports in the UWSS KB
• Learn more about Separation of Duties on the UWSS Security page in the Separation of Duties section
• Download a compressed folder of SOD resources

Annual Attestation

Once per year, each UW business unit completes a comprehensive review of its users' HRS and EPM access to remove inappropriate access and attest that the remaining access is appropriate. The OHR HRIS team will distribute reports of UW-Madison users' access to division approvers with a specific deadline to review and return.