Millions were at risk.
All because no one checked the checker.
Detective controls in Separation of Duties exist to stop that from happening. They are the safety net when preventive controls fail. They don’t just block— they watch, detect, and expose violations before the damage grows.
Separation of Duties (SoD) is the idea that no single person should control every step of a critical process. You don’t let one developer write, approve, and deploy their own code to production. You split responsibilities so mistakes or abuse require collusion to succeed. It’s a core practice in compliance, risk management, and secure engineering.
But preventive SoD alone has cracks. People bypass processes. Configurations drift. Permissions spread like weeds. That’s why detective controls matter. They monitor activity, record changes, uncover unusual patterns, and alert when a rule is broken.
When applied to systems, this means tracking deployments to see who pushed what and when. It means scanning logs for privilege use outside the expected workflow. It means auditing approvals against the list of authorized reviewers. It means catching a production database query from someone who should never touch production.