Describe a situation where a user requested access that would immediately create a critical SoD violation. How did you handle the access request (ARM), what stakeholders did you involve, and what interim or permanent controls did you implement to resolve the risk?

A finance analyst asked for both vendor master maintenance and payment approval access — a critical SoD hit. I paused the ARM approval, logged the request, and escalated to the finance process owner, internal audit, and the compliance team. Because business needed short-term capability, I provisioned Firefighter/EAM access for 72 hours with strict logging and twice-daily reviewer sign-off; every action was reviewed by a 5-person compliance team. For a permanent fix we split responsibilities, redesigned two roles in PFCG, and introduced a mandatory two-step payment approval control implemented in workflow. The change closed the SoD gap in 10 business days and reduced the business’s critical SoD exposure by 63% across the affected unit.