Segregation of duties

Splitting key steps of a process so no one person can both commit and hide an error or fraud.

The classic split is between authorising a transaction, recording it, keeping custody of the asset, and reconciling. In IT, developers shouldn’t move their own code into production, and security administrators shouldn’t approve their own access.

On the exam

Questions ask which combination of duties is the GREATEST risk. Look for the pair that lets one person create and conceal something, such as setting up vendors and approving payments to them.

Related terms

Compensating controlA control that reduces a risk when the preferred control isn’t possible.
Least privilegeGiving each user only the access their job needs.

Test yourself with today’s question of the day.