{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"financial_reporting","domain":["Financial Reporting Controls (SOX)","Access Control & Identity Management","Compliance, Audit & Assurance"],"inherent_rating":"high","taxonomy":["coso-erm-risk","sox-rmm-assertion"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-segregation-of-duties","description":"Incompatible duties (initiate, approve, record, and custody) concentrated in one role or via broad system access enable unauthorized or fraudulent transactions to be recorded and concealed.","details":{"category":"financial_reporting","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fin-segregation-of-duties","taxonomies":["coso-erm-risk","sox-rmm-assertion"],"treatment":"mitigate"},"id":"risk:fin-segregation-of-duties","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afin-segregation-of-duties","sourceIds":["aiuc-1","cobit-2019","gdpr","hipaa","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","pci-dss","soc2","sox"],"sourceUrl":null,"title":"Segregation-of-duties conflicts in financial processes","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0b37871dfe670524271af2e8e52d54d39f56878f71fd8973afdb4830c6b0f784","properties":{"rationale":"Role- and attribute-based enforcement applies the SoD separations defined for sensitive financial and administrative functions.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-05-9b7f3e34.json","sourceId":"uc:UC-ACCESS-05","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7d143264ea5f593c76c8be962b7cce4f865a5c409c14598577934e24edd35e32","properties":{"rationale":"This is the SoD control: dividing incompatible duties directly removes duty-conflict exposure.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-fin-05-52738635.json","sourceId":"uc:UC-FIN-05","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:916199d011646f8082ba3af42d5417a6a764bb27e8b965336bc420149a59b858","properties":{"rationale":"A defined, system-enforced SoD conflict matrix directly prevents concentration of incompatible duties.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-03-43eeb212.json","sourceId":"uc:UC-ACCESS-03","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a8b435dca563a57e72adbdadeabbe05b3d377d6d22184541cd8f2323364bf5bc","properties":{"rationale":"Approval workflows enforce that authorizers differ from recorders, supporting SoD.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-fin-04-70e42862.json","sourceId":"uc:UC-FIN-04","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d6640b3a210c70452c36ec1bea6d292ea4d2b20aa84e85033a128f07e81c635b","properties":{"rationale":"References embedded SoD, but the operative dedicated SoD control (conflict matrix, role design, periodic review) is UC-FIN-05; this umbrella only contributes.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-14-997de451.json","sourceId":"uc:UC-BCDR-14","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e5aa29f786a1e12838e44d690a11a41c8ee5b16bb00492e03bbb42e63d90968d","properties":{"rationale":"Owner recertification of accumulated entitlements detects toxic combinations that breach segregation of duties.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-02-0132e278.json","sourceId":"uc:UC-ACCESS-02","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f0b87acd2727b1785a6fd0cee779d658b3ca2f07308724f66735b80b427367b5","properties":{"rationale":"Separate admin accounts distinct from daily-use identities enforce develop-vs-deploy duty separation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-04-75180489.json","sourceId":"uc:UC-ACCESS-04","targetDetailPath":"/data/v1/records/risk-fin-segregation-of-duties-eb7ee015.json","targetId":"risk:fin-segregation-of-duties","type":"mitigates"}],"schemaVersion":1}