What it asks for. Conflicting duties and conflicting areas of responsibility should be segregated. The aim is to reduce the risk of fraud, error and bypassing of controls.
In practice. The organisation identifies combinations of duties that should not sit with one person, such as requesting and approving access, developing and deploying code to production, or creating and paying a supplier. These rules are enforced through system permissions and workflow approvals, and conflicts are checked during access reviews. Where small teams cannot fully separate duties, compensating controls such as monitoring and independent review are documented. Evidence includes a conflict matrix, role design, and reports of conflicts found and resolved.
Common gaps. Administrators often hold rights that let them change logs or approve their own changes. Compensating controls for small teams are claimed but not actually performed.