When maker-checker only exists in the handbook
Policy language about dual control is easy to write. Operating evidence is harder: approval timestamps, role bindings, and whether emergency overrides leave a trail someone reviews.
In payment flow testing we follow a transaction from initiation to settlement support and ask who could have completed each step alone. When the answer is “anyone with this role,” the exception is not theoretical — it is a concrete SoD gap with a named path.
Remediation usually mixes role redesign with monitoring of override use. Retesting after the change is what turns a finding into assurance.