SOD and Risks

Question

I was going through the SOD listed at http://www.*********************/sox_sod/sod_matrix.htm and I was wondering why the following are in conflicts:
Conflicts by business process
1) AP Invoice Verification and AP Payment Runs/ Clearing
2) Customer Master and Sales Order
3) Delivery Goods Issue and Cash Receipts/ AR Credit Memos
4) Delivery Goods Issue and Customer Master
5) Delivery Goods Issue and Sales Order
6) Purchase Order and  Vendor
7) Purchase Order and AP Invoice Verification
8) Purchase Order and AP Payment Runs/ Clearing
9) Purchase Order and Receiving
10) Receiving and Inventory Adjustments
11) Sales Order and Cash Receipts/ AR Credit Memos
12) Vendor and AP Invoice Verification
13) Vendor and AP Payment Runs/ Clearing
I would like to understand the risks involve in the above conflicts and what the risk levels are for each one.
Thanks in advance!
Bliss

Answer 1

I think you'd best talk to some functional people about this. I think I can see some danger in the process combinations you mention but the real risk depends on your company's processes and control measures.
For instance:
People who can edit customer masters and sales orders could easily set the customer delivery addres to a fake one (their own for instance), create a sales order and set the address back to the original. If the changes on delivery addresses are monitored/logged this is not such a big risk.
The same goes for a lot of items in your list. Basically you do not want transactional data and customer/vendor masterdata to be maintained by the same person. Just to avoid them changeing masterdata, creating orders, accepting invoices and releasing payment runs after which they can change back the masterdata.