Segregation of duties

Plain-language summary

Splitting conflicting duties and areas of responsibility between different people so that no one person can carry out, hide or approve their own fraud, misuse or error — with compensating checks where the organisation is too small to split them.

What the clause is really asking

The purpose is to reduce the chance that one person, acting alone, can misuse information or systems and get away with it, whether through fraud or an honest mistake. The control asks you to work out which duties and areas of responsibility conflict and keep them apart. Classic pairs: requesting and approving access; approving and implementing access; creating a supplier and paying it; writing code and deploying it to production; administering a system and reviewing its logs; designing a control and auditing it. Role-based access in your ERP and other key systems should enforce the split, and the combination of roles held by one person matters as much as any single role. The common misunderstanding is that a small organisation is exempt. It is not: where duties cannot be split, document the conflict and add compensating controls — management review of transaction logs, dual sign-off, alerts on privileged actions. Finance teams will recognise this from internal financial controls; reuse that work rather than starting again.

What auditors look for

Auditors ask for your list of conflicting duties or segregation matrix and then test it in the systems. They pull the user-role report from the ERP or finance system and look for one person holding both supplier-maintenance and payment-release rights, or a developer with production deployment rights. They take an access request and check that the approver was neither the requester nor the implementer. They look at who administers the logging platform and who reviews its output. Where you claim a compensating control, they ask for evidence it ran: signed log reviews, dual-approval records. The hard question: who here can make a change and approve it themselves?

Typical evidence

Segregation of duties matrix listing conflicting duties and roles; role definitions in key systems; user-role reports from ERP, finance and production systems; access requests showing separate requester, approver and implementer; documented exceptions with risk owner acceptance; compensating control records such as signed log reviews and dual-approval workflows; change records showing separate developer and deployer.

How to comply — recommendations

List the five to ten conflicts that matter most in your organisation — usually in finance, procurement, access management, change management and IT administration — and turn them into a simple matrix of roles that must not be combined. Configure role-based access in the ERP and other key systems to enforce it, then run a user-role report each quarter to catch conflicts that build up over time. Where one person must hold conflicting roles, record the exception with the risk owner's acceptance and set a compensating control: a monthly review of that person's transactions or privileged activity by a manager, signed and kept. Recheck the matrix whenever roles or systems change.

Common nonconformities

No analysis of conflicting duties; one person able to create suppliers and release payments; developers with unrestricted production rights; administrators reviewing their own activity logs; access requests approved by the requester; conflicts in small teams accepted without documented compensating controls; compensating log reviews claimed but not performed or not recorded.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.