risk
Segregation-of-duties conflicts in financial processes
Incompatible duties (initiate, approve, record, and custody) concentrated in one role or via broad system access enable unauthorized or fraudulent transactions to be recorded and concealed.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- financial_reporting
- domain
- Financial Reporting Controls (SOX)
- Access Control & Identity Management
- Compliance, Audit & Assurance
- taxonomy
- coso-erm-risk
- sox-rmm-assertion
- inherent_rating
- high
Details
- risk_id
- fin-segregation-of-duties
- category
- financial_reporting
- likelihood
- medium
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- coso-erm-risk
- sox-rmm-assertion
Source
No record-specific source URL is provided.
Connections
- UC-ACCESS-05 — Enforce approved authorizations for information and functions mitigates Segregation-of-duties conflicts in financial processes
- strength
- related
- rationale
- Role- and attribute-based enforcement applies the SoD separations defined for sensitive financial and administrative functions.
- UC-FIN-05 — Segregate incompatible financial duties mitigates Segregation-of-duties conflicts in financial processes
- strength
- primary
- rationale
- This is the SoD control: dividing incompatible duties directly removes duty-conflict exposure.
- UC-ACCESS-03 — Enforce least privilege, need-to-know, and segregation of duties mitigates Segregation-of-duties conflicts in financial processes
- strength
- primary
- rationale
- A defined, system-enforced SoD conflict matrix directly prevents concentration of incompatible duties.
- UC-FIN-04 — Authorize transactions with attributable approvals mitigates Segregation-of-duties conflicts in financial processes
- strength
- related
- rationale
- Approval workflows enforce that authorizers differ from recorders, supporting SoD.
- UC-BCDR-14 — Embed control activities in business processes mitigates Segregation-of-duties conflicts in financial processes
- strength
- related
- rationale
- References embedded SoD, but the operative dedicated SoD control (conflict matrix, role design, periodic review) is UC-FIN-05; this umbrella only contributes.
- UC-ACCESS-02 — Review user access rights periodically mitigates Segregation-of-duties conflicts in financial processes
- strength
- related
- rationale
- Owner recertification of accumulated entitlements detects toxic combinations that breach segregation of duties.
- UC-ACCESS-04 — Restrict privileged rights, utilities, and unauthorized software mitigates Segregation-of-duties conflicts in financial processes
- strength
- related
- rationale
- Separate admin accounts distinct from daily-use identities enforce develop-vs-deploy duty separation.