Role-Based Access and Segregation-of-Duties Monitoring in ERP Financial Systems with Behavioral Anomaly Scoring

Abstract

Separation of duties is one of the earliest technical controls in financial systems, and the standard monitoring approach in enterprise resource planning (ERP) is based on comparing role assignments against a static list of permission pairs, which are known as segregation-of-duties conflicts. This approach is auditable and cheap, but it cannot capture the conflicts emerging from combinations of individually compatible permissions, from fragmented rules, or from sequential user actions. This paper defines a monitoring architecture, which maintains a static conflict matrix as the decision-making authority, and adds two more layers, behavioral and sequence layers, which compare each user-transaction pair to the historical behavior of the user and her structurally similar peers, and to the reconstructed sequences of users, respectively. The paper formally defines effective permission computation, conflict specifications based on scope predicates, and the remediation decision problem in the presence of a limited reviewer capacity. It defines latent conflicts in one place and uses the definition in the rest of the paper. The paper also defines the protocol of evaluating behavioral layer performance, in which each comparison arm is compared against labeled populations of adverse cases at fixed reviewer capacities. The paper does not describe any empirical outcome. Its contribution is the architecture itself, the formal foundation behind it, the governance conditions under which behavioral scores can be employed, and the protocol, whose results need to be measured before the economics of the architecture can be assessed.