Segregation of duties
Also known as: Separation of Duties, Four-eyes principle, Dual control
This is a security principle where more than one person is required to complete a critical business process. It prevents any single individual from having enough authority to execute and conceal an error or fraud. In IT environments, this typically means separating administrative rights from operational user permissions.
Why it matters
Without these controls, a single employee could create a fake vendor and authorize payments to themselves without detection. An auditor would conclude that the internal control environment is "ineffective," often leading to a material weakness finding in an SOC 2 or SOX report. Such failures can result in significant financial loss through embezzlement or catastrophic data breaches via unauthorized system changes. Ultimately, the CISO or CFO is held accountable for these gaps during board-level risk reviews.
In practice
An auditor tests this during the "testing of controls" phase by reviewing a User Access Matrix. They request evidence such as identity and access management (IAM) logs and change tickets from tools like Jira or ServiceNow. This process produces an SoD Conflict Report listing users with incompatible permissions. For a first-year engagement, the auditor spends significant time mapping roles to business processes to establish a baseline. In repeat engagements, they focus on "delta" changes—specifically looking for permission creep that occurred since the last audit period.
Worked example
At FinTechFlow Inc., auditors reviewed the accounts payable process for FY2023. They requested a list of all users who could both create new vendors and approve payments within the ERP system. The auditor discovered that Sarah, a Senior Accountant, held both permissions from January to June 2023. This was flagged as a high-risk finding because it bypassed the "four-eyes" principle. FinTechFlow had to implement a compensating control—a monthly manager review of all new vendors—to remediate the risk before the final audit report was issued.
Common mistakes
- Confusing this with general access control; restricting access is not the same as splitting a process between two people.
- Relying on "trust" or verbal agreements instead of technical restrictions enforced within the software.
- Failing to review "super-user" or emergency accounts, which often bypass all constraints for maintenance purposes.
- Implementing written policies without verifying if the actual system permissions match those documents.
Frequently asked questions
What is the main goal of segregation of duties?
The primary objective is to prevent fraud and error by ensuring no single person has end-to-end control over a critical transaction. It forces collusion between two or more people for an illicit act to occur.
How does this differ from Least Privilege?
Least Privilege ensures a user only has the access they need for their role, while this principle ensures that specific high-risk combinations of permissions are split across different roles. One focuses on minimizing total access; the other focuses on dividing power.
How do you implement these controls in a small team with limited staff?
When staffing is too low to separate roles, organizations use "compensating controls" like mandatory supervisor reviews or detailed audit logs. These provide an after-the-fact check that replaces the preventative split of duties.
What evidence proves this is working during a SOC 2 audit?
Evidence typically includes a role-permission matrix, screenshots of system configurations preventing conflicting roles, and signed approval forms for access requests. Auditors also look for logs showing different users initiated and approved the same transaction.
When should an organization perform a review of these duties?
Reviews should occur during onboarding, when a user changes roles internally, and at least annually as part of a formal access certification process. This prevents "permission creep" where users accumulate conflicting rights over time.
More terms
Working papers · Compensating control · Significant deficiency · Risk appetite · Chain of custody · Internal control · Right to be forgotten · SOC 1