Segregation of Duties Doesn't Break at the Access Review. It Breaks the Day After.

Ask a CISO or an internal audit director what access certification actually proves, and the honest answer is narrower than most stakeholders assume: it proves that on the day the manager clicked approve, the access looked appropriate. It says nothing about the day after. Roles change. People leave. An engineer gets emergency elevated access to fix a production incident at 2 a.m. and nobody remembers to pull it back. None of that waits for the next scheduled review — and in most organizations, the next scheduled review is a quarter or a year away.

That gap has a price attached to it now. The Ponemon Institute's 2026 Global Cost of Insider Risks report, released February 24, 2026 and based on interviews with more than 8,750 IT and IT security practitioners across 354 organizations that had experienced at least one material insider event, found the average annual cost of insider risk reached $19.5 million. Negligence-driven incidents were the single largest category, at $10.3 million annually — a 17% year-over-year increase — and organizations took an average of 67 days to contain an incident once it was detected. Organizations with a formal insider risk program avoided roughly seven incidents and $8.2 million in costs a year compared with those that didn't have one.

Continuous access governance and segregation-of-duties (SoD) monitoring is the practice this article covers: an AI agent that continuously evaluates access across ERP and business applications against policy — conflicting role combinations, privileged and emergency access, dormant accounts, terminated employees with live credentials, self-approval, excessive entitlements, incomplete review campaigns, and anomalous service accounts — instead of relying on a periodic certification snapshot to catch what changed since the last one.

The Access Review Passed. The Exposure Window Didn't Close.

Access certification campaigns exist for a good reason, and no continuous-monitoring practice replaces them. A well-run campaign is policy-defined, targeted at the access that actually matters, and gives a named reviewer accountability for a specific decision. Gartner's guidance on modernizing access certification in 2026 pushes exactly this direction — recommender-assisted, exception-focused reviews where the reviewer sees what looks anomalous instead of rubber-stamping a long list of entitlements they don't have the context to evaluate. That's a real improvement over blanket recertification.

What it doesn't fix is the interval. Between two certification cycles — a quarter, six months, sometimes a full year in less mature programs — every joiner, mover, and leaver event happens without a corresponding governance check. A promotion adds a new role on top of an old one nobody removed, creating a segregation-of-duties conflict that didn't exist the day of the last review. An employee resigns, and the termination is processed in HR days or weeks before every downstream application actually revokes access. An incident responder gets emergency, elevated access to resolve a production outage, and the emergency ends long before the access does.

The word "negligence" is worth sitting with. It doesn't describe a hostile insider mounting a deliberate scheme — it describes access nobody actively decided to grant to a risk, but that accumulated anyway: a role that outlived its purpose, a termination that outran its offboarding checklist, an emergency exception that quietly became permanent. None of it looks alarming in isolation. All of it is exactly the kind of exception a point-in-time review is structurally unable to catch between cycles, because by definition it isn't looking.

What Continuous Access Governance Actually Monitors

In practice, the agent connects to the ERP, the IAM/IGA platform, individual business applications, and the HR system of record, and continuously tests the current state of access against defined policy rather than waiting for a scheduled campaign to run the same check. That means watching, every day, for: role combinations that create a segregation-of-duties conflict, such as the ability to both create a vendor and approve payment to it, or to both initiate and approve a journal entry; privileged and elevated access that falls outside normal usage patterns; dormant or orphaned accounts with no recent login activity that remain provisioned; employees marked terminated in HR who still hold live credentials in one or more downstream systems; emergency or "firefighter" access invoked during an incident that has not been reverted after its approved window closes; instances of self-approval, where the same identity requests and approves its own access change; excessive entitlements accumulated through successive role changes without a corresponding removal of prior access; access-review campaigns that are overdue, incomplete, or approved without meaningful evaluation; and anomalous behavior from service accounts and other non-human identities that typically receive far less scrutiny than human users despite often carrying broad system access.

What separates this from a standard IGA tool running scheduled certification workflows is the continuity and the explanation. Rather than surfacing a list of entitlements for a manager to attest to once a quarter, the agent states, for every exception, which policy was violated, when the condition first appeared, and why it matters — a terminated employee's credential is not just "still active," it's active nine days after HR processed the termination, in a finance system, with standing approval authority. That framing echoes the same "why, not just what" discipline that makes fraud and transaction-risk intelligence actionable rather than another alert queue, and it plugs directly into the broader continuous controls monitoring layer testing the same environment on an ongoing basis.

What the 2026 Data Is Already Signaling

The Ponemon findings aren't an isolated data point. Gartner's own 2026 identity and access management guidance is pushing organizations toward recommender-assisted, exception-focused certification precisely because blanket periodic reviews have proven too slow and too shallow to catch what matters — a tacit acknowledgment that the certification model, on its own, has a structural blind spot between cycles. ISACA's COBIT framework treats segregation of duties as a foundational control mapped directly to governance objectives, not a checklist item — and COBIT's broader emphasis on continuous monitoring as a governance discipline, rather than a periodic exercise, applies to access control with the same logic it applies to financial and operational controls elsewhere in this practice.

The COSO Internal Control–Integrated Framework's Control Activities component is explicit that access to data, applications, infrastructure, and facilities has to be restricted to authorized users and periodically reassessed — language written broadly enough to cover a continuous verification model, and increasingly interpreted that way as control environments modernize. The IIA's Global Internal Audit Standards similarly require internal audit to evaluate the adequacy of governance and control design, not just confirm that a review happened on schedule — a distinction that matters when the review itself is the control being tested. Read together, standard-setters and analysts are converging on the same conclusion this practice starts from: a control that only checks itself once a quarter is, for three months out of four, an assumption rather than an assurance.

An 8-Point Framework for Continuous Access Governance

None of this replaces the access owner, the control owner, or internal audit's judgment about what to do with a finding. It formalizes and runs continuously the same checks a well-run access governance program already performs on a schedule — just without waiting for the schedule.

Points four and five tend to draw the most scrutiny from CISOs and audit committees, and for good reason — a terminated employee with live access or an emergency grant that never reverted are exactly the exceptions most likely to become a headline. The agent's job is to surface both continuously and with evidence attached; deciding what happens next — immediate revocation, a documented exception, an escalation — stays with the access owner or control owner named in the organization's own governance policy.

Building the Programme: A Six-Step Delivery Playbook

Crest.Digital positions this work as a configurable "Risk Automation Pod" rather than a bespoke software build — a shared underlying stack of integration connectors, policy and rules engine, evidence repository, and dashboards, customized around a specific organization's applications, role matrix, and existing access-governance workflow.

Starting with a single high-risk application — the ERP financial module or the IAM platform's privileged-access population are common first choices — lets the validate step do genuinely useful work before the organization relies on continuous findings for anything decision-facing: comparing the agent's flagged exceptions against what an experienced access reviewer would independently conclude on the same population.

Where the Agent Stops and Judgment Stays Human

The question every CISO and audit director asks eventually is how much of this can run unattended. Continuous access governance is built around a specific division of labor, not automated revocation. Agents are genuinely strong at three things: watching every application, every day, at a volume and consistency no periodic campaign can match; cross-referencing HR, IAM, and application-level data that don't naturally reconcile with each other in real time; and stating, for every exception, exactly which policy was violated and since when — instead of leaving that reconstruction to whoever eventually notices.

What the agent doesn't do is decide that an exception should be revoked, grant or deny a documented business exception, or determine whether a finding rises to a reportable control deficiency. Those calls carry organizational accountability that belongs with the access owner, IT security leadership, or internal audit — which is why every finding routes to a named human before it becomes an access decision, not after.

This mirrors the accountability discipline running through Crest.Digital's wider agentic risk practice. If an agent flags a terminated employee's access as still active, someone needs to be able to reconstruct exactly what was checked, when, and against which policy — the same audit-trail requirement covered directly in AI agents need audit trails, and the ownership question that follows — who is accountable when an agent's finding drives a revocation or an exception — is addressed in the companion piece on GRC accountability. The same vendor-master monitoring discipline used in continuous procure-to-pay controls applies equally here — access risk and transaction risk are rarely independent, since the access that lets someone create a vendor is often the same access that lets them approve payment to it.

The underlying thesis is consistent with the rest of this practice: continuous monitoring proves that an exception exists and explains why it matters; it does not decide what should be done about it. In access governance, that gap has historically shown up as negligence — access that nobody actively decided to leave in place, but that nobody was watching for either. The fix is the one this practice keeps returning to: keep the access owner's judgment intact, and give it a complete, evidenced, continuously updated view to work from, instead of a quarterly snapshot that's already stale by the time anyone reads it.

Frequently Asked Questions