{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Governance, Policy & Oversight","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-08","description":"Identify duties and areas of responsibility that conflict — such as requesting versus approving access, development versus production deployment, or initiating versus approving transactions — and segregate them among different individuals or roles. Where segregation is impracticable, apply and document compensating controls such as enhanced monitoring, logging, or independent review.","details":{"control_category":"administrative","control_type":"preventive","domain":"Governance, Policy & Oversight","guidance":[],"members":[{"control_id":"A.5.3","coverage":"full","framework":"iso-27001","relationship":"equal"}],"statement":"Identify duties and areas of responsibility that conflict — such as requesting versus approving access, development versus production deployment, or initiating versus approving transactions — and segregate them among different individuals or roles. Where segregation is impracticable, apply and document compensating controls such as enhanced monitoring, logging, or independent review.","title":"Segregate conflicting duties and areas of responsibility","unified_id":"UC-GOV-08"},"id":"uc:UC-GOV-08","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-GOV-08","sourceIds":["iso-27001"],"sourceUrl":null,"title":"UC-GOV-08 — Segregate conflicting duties and areas of responsibility","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0e550dd633dbb6dc9bc2ffe433848c5bc7afe9030aaf7c9f09c44ad32576255e","properties":{"rationale":"Segregating conflicting duties directly remedies the absent segregation of duties the risk names.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","sourceId":"uc:UC-GOV-08","targetDetailPath":"/data/v1/records/risk-gov-weak-internal-control-7acb9117.json","targetId":"risk:gov-weak-internal-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:48a2786331de25004c3646dcb752f1d3e31e543365d71397609e73ad194e3f56","properties":{"control_id":"A.5.3","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","sourceId":"uc:UC-GOV-08","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-5-3-2763eb2a.json","targetId":"ctrl:iso-27001:A.5.3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:48c5ab76c552ffb3c3af7e7af4b3885b089211bce363d67082eff189a9952df9","properties":{},"sourceDetailPath":"/data/v1/records/wf-s5-a655abf2.json","sourceId":"wf:S5","targetDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","targetId":"uc:UC-GOV-08","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4eddf3e9270fa2ce86ff95641a33449818897bf6e8cbbea6e67ab32a5bc8e848","properties":{"rationale":"Initiate-versus-approve and front/back-office segregation is a core barrier to concealed rogue trading and position mismarking.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","sourceId":"uc:UC-GOV-08","targetDetailPath":"/data/v1/records/risk-fraud-unauthorized-trading-activity-e5d9d4b9.json","targetId":"risk:fraud-unauthorized-trading-activity","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:74f7d4179315c8479f8ac19e5ff1269d45541fca71ce6497b79946b060e9b913","properties":{},"sourceDetailPath":"/data/v1/records/wf-c7-acbef2ee.json","sourceId":"wf:C7","targetDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","targetId":"uc:UC-GOV-08","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7e794f4b48a1dfeac379283c9c406cbae1a95a673eba17b347259c26bab28955","properties":{},"sourceDetailPath":"/data/v1/records/wf-c19-ef930979.json","sourceId":"wf:C19","targetDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","targetId":"uc:UC-GOV-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:880356598968a9addedff174b8b44093b4e57706b26662565dbdce06f7cad3e2","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","targetId":"uc:UC-GOV-08","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a769fb76fbac3ad7843e9b7280ce8b161f2b165d72562241fe22c30122beaa43","properties":{"rationale":"SoD over transaction initiation and approval reduces undetected errors and misstatement feeding ICFR weakness.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","sourceId":"uc:UC-GOV-08","targetDetailPath":"/data/v1/records/risk-fin-icfr-material-weakness-cdd66323.json","targetId":"risk:fin-icfr-material-weakness","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b8c85c7f25e7f410ca0602a89b8ea3a8d7d05afb049ad59868b362553c4865aa","properties":{"rationale":"Separating initiate-versus-approve prevents one person from both perpetrating and concealing misappropriation.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","sourceId":"uc:UC-GOV-08","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"}],"schemaVersion":1}