What is separation of duties?

Separation of duties is synonymous with Segregation of Duties. It is a concept in which responsibilities and tasks within an organization are divided among different employees to minimize errors and fraud.

Does ISO 27001 require separation of duties?

Yes. ISO 27001, and derivative standards such as BIO and NEN 7510, explicitly require separation of conflicting duties and responsibilities.

Segregation of Duties (SoD)

What is Segregation of Duties (SoD)?

Segregation of Duties (SoD), also known as Separation of Duties, literally means separation of functions. The US standards organization NIST describes it, loosely translated, as the principle that no user should receive enough privileges to misuse systems for personal gain. A simple example is that the person who approves payroll payments should not be the same person who executes those payments. Otherwise, that person could first grant themselves an enormous salary and then process the payment without immediate detection.

This makes Segregation of Duties an important element of secure and ethical business operations. In this article, we further explore the topic and explain the role Identity and Access Management systems can play in SoD.

Examples of Segregation of Duties?

Below are concrete examples of processes where Segregation of Duties is applied:

Procurement versus Payment: A procurement manager or their staff are responsible for vendor selection, tenders, and purchase orders. They must not also approve and release the final supplier invoices for payment.
Approval versus Accounting: The employee who approves certain expenses must never be the one to post them in the accounting system.
Inventory Management versus Stocktaking: The warehouse inventory manager must not perform or audit the inventory counts.
Project Management versus Project Evaluation: Project managers are responsible for project execution, but must never conduct the evaluation themselves or grant formal sign-off.

There are many examples, but they all share the same premise. No business process with significant financial or other major organizational impact should be executed and controlled end-to-end by a single person or a small team. Another term used in this context is the four-eyes principle.

Why is SoD Important?

Segregation of Duties is important to prevent intentional abuse and fraud. Consistent internal controls ensure that multiple people are responsible for different parts of operations and prevent individuals from using their authority to benefit themselves or others.

However, SoD also prevents people from drifting into a gray area. Consider a well-intentioned business owner facing financial distress. What starts as creative accounting to pay invoices and salaries can quickly lead to fraud. Never intended, yet harmful and unlawful.

Therefore, every organization of reasonable size should have an external accountant who independently assesses operations and role separation. For the same reason, there are more and more specific domains in which partners, customers, or the government require an external auditor to issue an opinion. Consider our field at Tools4ever, information security, where it is important for customers and partners that we meet the ISO 27001 standard and are certified accordingly.

Benefits of Segregation of Duties

This yields multiple benefits for organizations. Some benefits are:

Reduced Risk of Fraud and Abuse: As described, stronger internal controls make it much more difficult for employees to misuse privileges for personal or third-party gain.
Optimized Operations: While not the primary objective of role separation, processes often become smarter, more efficient, and more accurate. You prevent not only fraud but also unintentional errors because someone is always providing oversight.
Improved Compliance: SoD is often a strict requirement in modern regulations. The Dutch Government Information Security Baseline (BIO) explicitly states that conflicting duties and responsibilities must be separated to reduce the likelihood of unauthorized or unintentional changes or misuse of the organization’s assets.

How Do You Apply the Principle of Segregation of Duties?

Implementing Segregation of Duties in a structured way can start with a SoD project or program. The goal is to map all relevant processes and the organizational structure, and then evaluate the current division of duties. This reveals areas where a single person or a small team has excessive control. Based on that analysis, tasks and responsibilities must be reassigned. This can be complex and requires extensive coordination. It is not a one-time activity; it is important to assess role separation regularly.

Technology is essential. Business processes are increasingly automated, with many tasks executed by ERP, CRM, and other financial, planning, and management systems. All users of these systems must be granted appropriate access rights. Everyone should have the rights needed to do their job, and no more. This principle, known as the Principle of Least Privilege, is important for effectively supporting Segregation of Duties.

A modern IAM platform, such as HelloID, supports you in multiple ways when implementing separation of duties:

HelloID Provisioning enables automated assignment of access rights based on attributes, such as role, competencies, department, and work location. Within the business rules, so-called Toxic Policies can be used to prevent the assignment of conflicting entitlements.
In addition, with Service Automation, you can ensure that granting additional access rights is always automatically preceded by approval from the appropriate manager or managers. Only then does the system adjust the rights. If desired, you can set a time limit so that access rights are revoked at the specified time. You can also set segregation policies so that a user who is granted access to application or functionality A cannot also receive access to application or functionality B.
HelloID also supports the separation of duties among the various administrative functions around your IAM environment. For example, configuration management can be performed by staff different from those who issue individual access rights.
Last but not least, all actions are logged automatically. In the event of incidents or issues, it is always traceable who performed which actions and when.