Segregation of Duties Violations(5.6.6)

Segregation of duties (SoD) is a fundamental compliance control: the person who creates work should not also be the sole person who approves its completion. When the same actor creates and closes an issue without any other actor contributing, it is a SoD violation — a signal that independent review is not happening.

Each closure is attributed to the type of account that made it, as Jira reports it. The violation count and its rate cover closures made by people's accounts. An app account, such as Automation for Jira, that creates and closes its own issues is recorded as app activity and shown beside the people's figures rather than inside them; closures by service-desk customers and by accounts Jira returned no type for are shown the same way, and none of them is counted as a person's. A closure made by an account that has since been erased carries no closer and is not counted. An action Jira records under a person's account counts as that person's, even when a tool acted on their behalf.

This visual tracks the rate of SoD violations over time so you can see whether this pattern is isolated or systematic.

What you can conclude

• A rising SoD violation rate indicates that independent review is becoming less common. Where your control framework expects two-actor closure, these are the cases that would not meet it.
• A consistently low SoD violation rate indicates that separation of duties is being maintained across the portfolio.
• A spike in a specific week may correlate with a sprint crunch or a specific event — worth investigating the context.

How this chart works

Weekly stacked bar chart showing count of SoD violations (creator = closer, no peer involvement) alongside total closures. Each count is also recorded by the closer's account type (person, app, customer, unknown, erased); an issue closed in the same week by accounts of two types counts once in each. Use the date and project filters to focus on specific teams or periods.

Separation of duties is a common control objective in DORA and NIS2 programs; teams preparing either review commonly start here.

The week in progress is shown at its count so far. Because the week is not yet complete, it covers only what has been recorded up to now and can only grow as the week closes.