Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Segregation of Duties
What SoD prevents
Segregation of duties splits a task so that no single person can both carry it out and hide a mistake or fraud. The classic duties to keep apart are authorising, recording, custody of assets and reconciling.
Separating duties step by step
IT conflicts that matter
Privileged IT users can often bypass application-level segregation, so SoD reviews must include administrators and check actual system access, not job descriptions.
When you can’t separate
Compensating controls only work if someone independent of the conflict performs them.
Example. A five-person finance team can’t fully separate payment entry and approval. The CFO reviews a weekly report of all payments and supplier bank changes, and the bank sends confirmations to the CFO directly.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| BEST evidence of SoD | Actual system access compared with an SoD rule set |
| Small team can’t separate duties | Compensating controls performed by someone independent |
| GREATEST SoD risk in IT | A developer or admin who can change production and hide it |
| Purpose of SoD | Prevent one person committing and concealing errors or fraud |
In short
- Segregation of duties (SoD) means no single person can both carry out and conceal an error or fraud.
- Classic duties to separate are authorising, recording, custody of assets and reconciling.
- In IT, the worst conflicts let someone change systems or access and also hide it.
- Where SoD isn't practical, compensating controls such as independent review, logging and reconciliation reduce the risk.
- SoD must be checked against actual system access, not job descriptions.
Exam traps
- Relying on job descriptions or org charts to prove segregation.
- Choosing 'hire more staff' as the answer for a small team; compensating controls are expected.
- Accepting compensating controls performed by the same person who holds the conflict.
- Forgetting that privileged IT users can often bypass application-level SoD.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Separating duties step by step
IT conflicts that matter
When you can't separate
ExampleA five-person finance team can't fully separate payment entry and approval. The CFO reviews a weekly report of all payments and supplier bank changes, and the bank sends confirmations to the CFO directly.
1 / 8