An organization is attempting to strengthen the configuration of its enterprise resource planning (ERP) software in order to enforce sufficient segregation of duties (SoD). Which of the following appr

Frequent audits detect SoD violations after the fact but do not proactively prevent conflicting access from being assigned, making this a detective control rather than a preventive one that directly enforces SoD.

Strengthened authentication (e.g., MFA) verifies identity but does not address whether a single authenticated user holds conflicting privileges across ERP functions, which is the core concern of SoD.

Applying least-privilege based only on existing employee roles reduces excessive access but does not evaluate whether current role assignments create SoD conflicts, as employees may legitimately hold roles that are nonetheless incompatible from an SoD perspective.

SoD is fundamentally about ensuring that no single individual can perform incompatible or conflicting functions end-to-end, such as initiating and approving transactions. Reviewing employee responsibilities alongside ERP access profiles allows an organization to identify and remediate role conflicts by differentiating mission activities across separate users or roles. This dual-lens approach-examining both what employees do and what the system allows them to do-is the definitive method for enforcing true SoD within an ERP.