Find Resources & Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

You must be logged in to join this group.

PO4.11 - Segregation of Duties

This topic is intended to enable collaboration and sharing of information to facilitate a better understanding and approach to implementing this COBIT control objective based on the risk, value and guidance provided by its corresponding control practices.

COBIT Control Objective PO4.11 - Segregation of Duties is contained within Process Popup Define the IT Processes, Organisation and Relationships

Learn more about COBIT and related publications.

Click “Join This Community” to be able to actively participate in discussions and contribute content. You must be an ISACA member to join this topic. Join ISACA now.

 
This Topic Has:
108 Members
0 Online
5319 Visits

Community Leader

Knowledge Center Manager

Knowledge Center Manager

Title: Become a Topic Leader!

Badge: Energizer


Segregation of Duties

Implement a division of roles and responsibilities that reduces the possibility for a single individual to compromise a critical process. Make sure that personnel are performing only authorised duties relevant to their respective jobs and positions.

View value and Risk Drivers  help

Hide value and Risk Drivers help


Value Drivers

  • Effective and efficient functioning of business-critical systems and processes
  • Proper protection of information assets
  • Reduced risk of financial loss and reputational damage
  Risk Drivers
  • Inappropriate subversion of critical processes
  • Financial loss and reputational damage
  • Malicious or unintentional damages
  • Non-compliance with external requirements for segregation of materially significant systems and business processes

View Control Practices  help

Hide Control Practices  help

  1. Establish standards that enforce appropriate segregation of duties. Periodically review and update the standards.
  2. Identify and document conflicting functions, such as the ability to initiate, authorise, execute and verify transactions. Ensure that segregation of duties is enforced physically and logically where appropriate.
  3. Ensure that procedures address the maintenance of appropriate segregation of duties and responsibilities during periods when regular personnel are unavailable (e.g., vacations, illness or leaves of absence).
  4. Review the impact on segregation of duties and reassign responsibilities where necessary when job roles and responsibilities are created or updated as a result of changing business needs or reorganisation.
  5. Design and implement compensating controls (e.g., regular review of individuals’ activities by senior IT management) where the size or nature of the IT function precludes full segregation of duties.

Discussions: 4 total

Must be a Topic member to contribute
Does anyone have any references or experience with SOD as it applies to Healthcare Revenue Cycle SOD?  I'm looking to start an Revenue Cycle SOD effort with a Healthcare client and would like to find an existing starting point if one already exists.
Yuriy022 | 11/14/2016 12:32:44 PM | COMMENTS(0)
Hello: Does anyone have suggestions or ideas on the best way to perform Segregation of Duties in NetSuite? Thank you. Regards, Karen Andersen
Karen953 | 7/22/2016 8:15:40 AM | COMMENTS(0)
Dear all, I would like to get a piece of advice about strange suggestion that I received. I was invited to a meeting to discuss on the skippable scope for project audit under PMO(Project management office)  functions.You may pop up the question mark when ...
Kyeong Hee341 | 10/19/2015 1:46:08 PM | COMMENTS(1)
Hi! I read an article of the Journal (What Every IT Auditor Should Know About Proper Segregation of Incompatible IT Activities). AT the bottom of the article there's a figure (Sample Organization Chart Demonstrating Effectual Segregation of IT Duties). ...
Lia471 | 11/15/2012 1:16:49 PM | COMMENTS(0)

Documents & Publications: 173 total

Must be a Topic member to contribute
View All »
Downloads
Posted by FarmService 1320 days ago
Downloads
Posted by FarmService 2406 days ago
Books
Posted by ISACA 133 days ago
Books
Posted by ISACA 624 days ago

Events & Online Learning: 10 total

16 Mar 2015
ISACA International Event
Orlando, FL, USA
15 Jun 2015
ISACA International Event
Ciudad de México, Mexico
1 Aug 2016
ISACA International Event
Chicago, IL, USA
16 Aug 2017
ISACA International Event
Grapevine, Texas, US
2018 GRC Conference - 13-15 August , Nashville, TN. Explore the future of Governance Risk and Control through expert-led workshops and sessions developed by the IIA and ISACA. Register early for our GRC learning tracks.

Journal Articles: 215 total

Volume 3, 2107
by Jayakumar Sundaram, CISA, ISO 27001 LA
The SoA is a continuously updated and controlled document that provides an overview of information security implementation.
Volume 6, 2017
by Daniel Gnana, CISA, ISO/IEC 27001:2013 LA, PRINCE2
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)’s ISO/IEC 27001:2013 standard has defined the requirements for an information security management system (ISMS).
Volume 6, 2017
by Guy Pearce
The modern GRC landscape has a significant impact on how an enterprise-scale big data project would be undertaken today.
Volume 6, 2017
by Pedro Alexandre de Freitas Pereira, CCNA
The security of technology has become an increasing global concern. For some professionals such as network managers or security managers, this subject is intrinsically linked to their daily work.
Volume 6, 2017
by ISACA | Reviewed by Ravi Ayappa, Ph.D., CISA, CRISC, CISM
This book is an ideal handbook for auditors, database administrators (DBAs) and security practitioners who would like detailed insight on Oracle database security.
Volume 5, 2017
by Michael Werneburg, CIA, PMP
Service organizations with a bespoke application in a regulated industry have special challenges in addressing application vulnerabilities.

Wikis: 2 total

Blog Posts: 182 total

Globally, many organizations are spending millions of dollars protecting their businesses and its enabling infrastructure, but are they really secure? We shall discuss answer to this question in a little while. We need to understand core basics before we ...
Posted By : SudireddyRamreddy | 0 comments
Hello fellow members COBIT 5 is an excellent guide to developing ICT Governance Frameworks. Many organisations have well documented Frameworks but find it challenging when it comes to implementation. The objective of this post is to start a debate o...
Posted By : Thansen Singh | 0 comments
In your experience, what is the best Risk Management definition and how to explain to to other IT teams the importance of Risk Management and how that is related with a chosen standard, methodology (ISO 27001, CObit, OCTAVE, etc) What is the source defini...
Posted By : Isaias_Telhado | 0 comments
2 Nov 2017
Employees are big phishing targets due to busy schedules and lack of time to inspect every email they receive throughout the day.     Be on the lookout for strange company requests that do not match a normal day exercise.  Follow up on an...
Posted By : Robert658 | 0 comments
Tools What to do for such an assignment practical auditing of the OS and Database CLOUD Computing challenges Third Party integration and the Audit functions
Posted By : Kemza | 0 comments
What do you think by starting new chapter at Nepal: 1. What benifit will Nepal Get?2. What ICT sectrer will Get?3. What ISACA's current/future member will Get?4. What IS Auditor will get?
Posted By : Dr. Pawan K. Sharma | 0 comments