Segregation of Duties Warnings

What the warning means

Some pairs of permissions are risky together rather than individually. Being able to raise a refund is fine. Being able to approve one is fine. Being able to do both means that person can move money out of the shop with nobody else involved. That is what the amber warning is telling you.

The pairs Fixmo watches

These are the combinations that trigger a warning.

• Raise a refund and approve it
• Approve a refund and pay it out
• Record a payment and delete the record of one
• Raise a purchase order and sign for its delivery
• Raise an exchange and approve it
• Ask for a document edit and approve the request
• Complete a sale and void one

Why Fixmo allows it anyway

Because blocking it would make Fixmo unusable for a two-person shop. If there are only two of you, somebody has to be able to do both, and a rule that stops the shop working is not a control, it is an obstacle. So Fixmo warns, lets you decide, and writes down that the decision was made.

What gets recorded

When you accept a warning, the change log marks that permission with 'risk accepted' next to it. That is there so a later review, by you or by an accountant, can find every place where a control was deliberately relaxed, rather than having to guess.