Find Resources & Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

You must be logged in to join this group.

PO4.11 - Segregation of Duties

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective PO4.11 - Segregation of Duties is contained within Process Popup Define the IT Processes, Organisation and Relationships

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
112 Members
0 Online
5476 Visits

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Badge: Energizer


Segregation of Duties

Implement a division of roles and responsibilities that reduces the possibility for a single individual to compromise a critical process. Make sure that personnel are performing only authorised duties relevant to their respective jobs and positions.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Effective and efficient functioning of business-critical systems and processes
  • Proper protection of information assets
  • Reduced risk of financial loss and reputational damage
  Risk Drivers
  • Inappropriate subversion of critical processes
  • Financial loss and reputational damage
  • Malicious or unintentional damages
  • Non-compliance with external requirements for segregation of materially significant systems and business processes

View Control Practices  help

Hide Control Practices  help

  1. Establish standards that enforce appropriate segregation of duties. Periodically review and update the standards.
  2. Identify and document conflicting functions, such as the ability to initiate, authorise, execute and verify transactions. Ensure that segregation of duties is enforced physically and logically where appropriate.
  3. Ensure that procedures address the maintenance of appropriate segregation of duties and responsibilities during periods when regular personnel are unavailable (e.g., vacations, illness or leaves of absence).
  4. Review the impact on segregation of duties and reassign responsibilities where necessary when job roles and responsibilities are created or updated as a result of changing business needs or reorganisation.
  5. Design and implement compensating controls (e.g., regular review of individuals’ activities by senior IT management) where the size or nature of the IT function precludes full segregation of duties.

Discussions: 5 total

Must be a Topic member to contribute
Hi All,having some difficulty giving some guidance to an IT Manager in the way of SOD best-practices using AD groups. There's lots of discussion out there about conflicting roles, but it's usually a review of financial (vendor creator vs. vendor payer) or...
Jeff Murfin | 12/28/2017 12:41:34 PM | COMMENTS(0)
Does anyone have any references or experience with SOD as it applies to Healthcare Revenue Cycle SOD?  I'm looking to start an Revenue Cycle SOD effort with a Healthcare client and would like to find an existing starting point if one already exists.
Yuriy022 | 11/14/2016 12:32:44 PM | COMMENTS(0)
Hello: Does anyone have suggestions or ideas on the best way to perform Segregation of Duties in NetSuite? Thank you. Regards, Karen Andersen
Karen953 | 7/22/2016 8:15:40 AM | COMMENTS(0)
Dear all, I would like to get a piece of advice about strange suggestion that I received. I was invited to a meeting to discuss on the skippable scope for project audit under PMO(Project management office)  functions.You may pop up the question mark when ...
Kyeong Hee341 | 10/19/2015 1:46:08 PM | COMMENTS(1)
Hi! I read an article of the Journal (What Every IT Auditor Should Know About Proper Segregation of Incompatible IT Activities). AT the bottom of the article there's a figure (Sample Organization Chart Demonstrating Effectual Segregation of IT Duties). ...
Lia471 | 11/15/2012 1:16:49 PM | COMMENTS(0)

Documents & Publications: 167 total

Must be a Topic member to contribute
View All »
Downloads
Posted by FarmService 1473 days ago
Downloads
Posted by FarmService 2559 days ago
Books
Posted by ISACA 94 days ago
Books
Posted by ISACA 777 days ago

Events & Online Learning: 9 total

Journal Articles: 221 total

Volume 3, 2107
by Jayakumar Sundaram, CISA, ISO 27001 LA
The SoA is a continuously updated and controlled document that provides an overview of information security implementation.
Volume 2, 2018
by Ron Davidson
The threat landscape has changed significantly for operational technology (OT) environments as their connectivity to IT networks and the Internet has exponentially increased.
Volume 2, 2018
by Robert E. Davis, DBA, CISA, CICA
Innovation is the process of transforming an idea or concept into a functional and marketable value proposition reflecting creative opportunity.
Volume 2, 2018
by Guy Pearce
With the increasingly rapid rate of change in technology, key questions organizations face are how to make sense of it all, how to apply it practically and how to do these things before their competitors do.
Volume 2, 2018
by Vijayavanitha Sankarapandian, CISA, CIA
Transparency and compliance, coupled with the ability to gather relevant and accurate data, lead to efficient governance by a government.
Volume 1, 2018
by Aditya K. Sood, Ph.D., and Rehan Jalil
With the robust requirements listed by upcoming regulations, such as GDPR, the importance of a cloud app security solution cannot be ignored.

Wikis: 2 total

Blog Posts: 198 total

20 Apr 2018
Good day. I have an interesting situation that came about just this week.  New career opportunities are not all that they seem to be.  What I thought was going to be a great career change ended up in disaster.  With only one week and two day's, I was dism...
Posted By : Brian824 | 0 comments
2 Apr 2018
After privacy was silently lost in modern era, GDPR will try to put the ghost back in the bottle. Will it succeed?
Posted By : Dragan Pleskonjic | 0 comments
What do you think: when artificial intelligence (AI) will be smarter than humans? Can you predict it and if yes, when it will approximately happen in your opinion? Vote in poll at link below, please: http://securitypredictions.xyz/when-artificial-intellig...
Posted By : Dragan Pleskonjic | 3 comments
Have you experienced ransomware attack so far and, if yes, what did you do to resolve? I set up Twitter poll here: https://twitter.com/DPleskonjic/status/953608717399941120 It lasts for seven days. Thank you for taking part in the poll.
Posted By : Dragan Pleskonjic | 5 comments
21 Feb 2018
We are happy to announce that  on Feb//2018  the ISACA awareness session  was held in Baghdad.This the first time to speak about ISACA Value in Iraq.Professional from government and private sector were excited to hear about ISACA value and they started to...
Posted By : Ali099 | 1 comments
Ransomware is a form of malware and is engineered to infect your personal computer and restrict access in some way, while demanding payment or ransom  to remove the restriction. First identified in 1989  under the name of PC Cyborg, today there are over 2...
Posted By : Robert658 | 2 comments