Compensating Controls and Segregation of Duties

Why split the work?

If one person can order goods, approve the order, receive the delivery and pay the invoice, they could set up a fake supplier, “buy” from it, and pay themselves. Nobody would ever notice.

Segregation of duties splits a process between different people so that one person’s mistake or fraud is caught by someone else. To get around it, two people would have to work together (collusion), which is much less likely.

The four duties to keep apart

Anyone holding two of these can both commit and conceal a problem. In IT, typical clashes are developers with access to production, security administrators who also use business systems, and DBAs who approve their own data changes. IT segregation of duties is covered in more detail in Domain 2.

How auditors test SoD

1. Build or get a conflict matrix: which duties or system rights clash for this process.
2. Pull actual access from the systems: roles and permissions for every user. Check across applications, because rights in two systems can add up to a conflict.
3. Find users holding conflicting rights.
4. Watch the work. Who actually does each task? Shared passwords or informal “covering for each other” can defeat a design that looks fine on paper.
5. Where conflicts exist, check whether compensating controls cover them.

When the team is too small

A small IT team can’t separate every duty. The exam’s expected answer is not “hire more people”. It’s a compensating control: making sure someone independent checks what the person did.

• Independent review of the work or transactions
• Logs and audit trails the person can’t edit, reviewed by someone else
• Reconciliations performed by someone else
• Exception reports reviewed independently
• Job rotation, so someone else sees the work
• Mandatory leave: schemes that need constant attention tend to unravel when the person is away. It’s a detective control, not a perk.

Example. In a small company, one IT administrator can create users, change settings and access the finance system. Hiring isn’t an option. Each month the finance manager receives a system-generated report of every user created, role changed and administrator login, checks each one against an approved request, and signs it off.

Is the compensating control any good?

• Is the reviewer independent of the activity?
• Is the evidence reliable: system-generated, complete, not editable by the person being checked?
• Is the review timely and documented?
• Are exceptions followed up?

How the exam asks about it

In short

• Segregation of duties (SoD) splits incompatible jobs between people so no one person can both make and hide a mistake or a fraud.
• The four duties to keep apart: authorising, recording, holding the asset (custody), and checking (verification).
• SoD is tested by comparing actual system access with a conflict matrix, reviewing job descriptions, and watching who really does each task.
• When duties can't be separated, compensating controls reduce the risk: independent review, logs reviewed by someone else, reconciliations, job rotation, mandatory leave.
• Most compensating controls are detective: they don't stop the act, but make hiding it hard.
• Check conflicts across systems; access in two applications can add up to a conflict.

Exam traps

• In small organisations, the expected answer is a compensating control, not hiring more people.
• Role-based access doesn't guarantee SoD; a role itself can contain a conflict.
• A review only compensates if the reviewer is independent of the activity.
• Mandatory leave is a detective control for fraud that needs constant hiding.
• An administrator reviewing their own activity log is not a compensating control.

Slides

Click the slide and use the arrow keys. F toggles full screen.