Segregation of Duties in IT: Matrix and Analysis
How to build and interpret a segregation of duties matrix for IT functions, and how CISA candidates should approach SoD conflict analysis.
Segregation of duties (SoD) is one of the oldest and most tested concepts on the CISA exam, and for good reason: when a single individual can both perform and conceal an error or fraudulent act, the risk of undetected misstatement or malicious activity rises sharply. In an IT context, SoD extends beyond the classic finance example of separating requisition, approval, and payment. It includes separating systems development from operations, separating database administration from application security administration, and separating the ability to request access from the ability to grant access.
Building a Segregation of Duties Matrix
An SoD matrix is a tool that maps roles, functions, or transaction codes against one another to identify combinations that create unacceptable risk. The matrix typically lists all sensitive functions along both axes and marks cells where a conflict exists, such as the intersection of 'create vendor master record' and 'approve vendor payment.' In IT-specific matrices, common conflict pairs include: programmer with production access, database administrator with security administration rights, and network administrator with the ability to modify firewall rule sets without independent review.
Common IT SoD Conflicts
- Developers who can migrate their own code to production without independent change approval
- Security administrators who can grant themselves elevated access without a second approver
- Database administrators who can both modify data and disable audit logging
- Help desk staff who can reset passwords and also access the accounts they reset
- Backup operators who can also alter or delete the same backups they manage
Interpreting the Matrix
Once a matrix identifies theoretical conflicts, the auditor must determine whether those conflicts actually exist in practice by mapping real user access to the roles defined in the matrix. This typically involves extracting user-to-role or user-to-transaction-code assignments from the system and running them against the conflict rules, often using GRC tools or scripted analysis. A theoretical conflict that no user actually holds is a lower priority than one where several users hold both conflicting rights simultaneously.
Compensating Controls
In smaller organizations, complete segregation is often impractical due to limited staffing. In these cases, auditors evaluate whether compensating controls exist, such as independent management review of system logs, periodic access recertification, or a required second approval workflow enforced by the system itself. A compensating control must be performed by someone independent of the conflicting functions and must be capable of detecting an error or irregularity in a timely manner to be considered effective.
Auditing SoD Effectively
Effective SoD auditing combines a well-designed matrix, automated access extraction and analysis, interviews with process owners to understand the practical reality of role assignments, and testing of any compensating controls identified. Auditors should also examine how SoD conflicts are identified and remediated over time, ideally through a periodic access review process integrated into the organization's identity governance program. A mature organization will have automated SoD conflict detection built directly into its provisioning workflow, preventing conflicting access from ever being granted in the first place rather than detecting it after the fact.
Exam Focus
CISA candidates should remember that SoD is a preventive control by design, but when segregation cannot be fully achieved, detective compensating controls become essential. Questions often present a scenario with limited IT staff and ask candidates to identify the best compensating control, so understanding the hierarchy of preventive, detective, and corrective controls in the SoD context is critical exam knowledge.