When we talk about IT security, the first things that come to mind are programs such as firewalls or malware detection software. However, security is as much about the organization systems and process your company has in place as anything else. Of those organizational structures, one of the most important matter is how companies assign responsibility for certain IT-related tasks. This is called Segregation of Duties.
What is Segregation of Duties
Segregation of Duties is an internal control that prevents a single person from completing two or more tasks in a business process. Separation of Duties, as it relates to security, has two primary objectives. The first is the prevention of conflict of interest, the appearance of conflict of interest, wrongful acts, fraud, abuse and errors. The second is the detection of control failures that include security breaches, information theft and circumvention of security controls. Organizations require Segregation of Duties controls to separate duties among more than one individual to complete tasks in a business process to mitigate the risk of fraud, waste and error (for example in financial enterprises).
SoD processes break down tasks, which can be completed by one individual, into multiple tasks. The goal is to ensure that control is never in the hands of one individual, either by splitting the transaction into 2 or more pieces, or requiring sign-off approval from another party before completion.
Breaking tasks down prevents risks, however, it doesn’t come without other costs. For one, it can negatively impact business efficiency. Payroll management, for example, often faces error and fraud risks. A common SoD for payroll is to ask one employee to be responsible for setting up the payroll run and asking another employee to be responsible for signing checks. This way, there is no short circuit where someone could pay themselves or a colleague more or less than they are entitled to.
The Importance of Segregation of Duties
The concept behind Segregation of Duties is that the duty of running a business should be divided among several people, so that no one person has the power to cause damage to the business or to perform fraudulent or criminal activity. Separation of duties is an important part of risk management, and also relates to adhering to SOX compliance.
Segregation of Duties is recommended across the enterprise, but it’s arguably most critical in accounting, cybersecurity, and information technology departments. Individuals in these roles can cause significant damage to a company, whether inadvertently or intentionally. Therefore, finance and security leaders should pay attention to separation of duties. It is important to build a role with IT security capabilities so that no one can abuse it.
Segregation of Duties in IT security
The issue of separation of duties is of a great importance. A lack of clear and concise responsibilities for the CSO and chief information security officer has fuelled confusion. It is imperative that there be separation between the development, operation and testing of security and all controls. Similarly, if one individual is responsible for both developing and testing a security system, they are more likely to be blind to its weaknesses.
To avoid these situations, responsibilities must be assigned to individuals in such a way as to establish checks and balances within the system. Different people must be responsible for different parts of critical IT processes, and there must be regular internal audits performed by individuals who are not part of the IT organization, and report directly to the CEO or board of directors. SoD in the IT department can prevent control failures that can result in disastrous consequences, such as data theft or sabotage of corporate systems.
An important part of SoD implementation is the principle of least privilege, as well. Everyone should have the minimum permissions they need to perform their duties. Even within a certain IT system, individuals should only have access to the data and features they specifically require. Permissions should be regularly reviewed, and revoked in case an employee changed role, no longer participates in a certain activity, or has left the company.
SOD in risk management
Segregation of Duties is a fundamental internal accounting control prohibiting single entities from possessing unchecked power to conceal financial errors or misappropriate assets in their specific role. SOD controls require a thorough analysis of all accounting roles with the segregation of all duties deemed incompatible. For example, someone responsible for inventory custody can’t also oversee transactional recordkeeping regarding inventory.
SOD policies can also help manage risk in information technology by preventing control failures around access permission. By segregating workflow duties, your team ensures the same individual or group isn’t responsible for multiple steps in the access permission process.
When it comes to risk management in Governance Risk and Compliance, effective SOD practices can help reduce innocent employee errors and catch the not-so-innocent fraudulent filings. Both can elevate compliance risk by violating regulations like the Sarbanes Oxley Act of 2002, penalizing companies for filing incorrect financial information capable of misleading investors
Including a Segregation of Duties control component in your risk management strategy helps reduce risks that can be costly to your organization – whether it’s financial, damage to your brand, or the stiff penalties imposed for regulatory infractions. By segregating duties to minimize errors and potential fraud, your organization can remain at or below its desired risk threshold. Working with experienced cybersecurity experts is crucial for companies of all sizes, across all industries. That is why businesses have to take charge of their own protection and implement strategies designed to limit the damage a single attack is capable of.