ISO 27001 Segregation of Duties: Design and Test Control A.5.3

Segregation of duties reduces the opportunity for one person to complete a harmful action without independent involvement or detection. In ISO/IEC 27001:2022, the relevant Annex A reference is control A.5.3. Older material may use A.6.1.2 from the 2013 control set; an organisation working to the 2022 edition should use current numbering in its control mapping and Statement of Applicability.

The principle sounds simple, but a rule such as “requestor cannot approve” covers only one conflict. Effective design considers initiation, authorisation, execution, custody, recording, monitoring and review across business processes and technical administration.

Define the harmful combinations

Start with scenarios, not job titles. Ask which combined abilities could let a person create, conceal or approve an unacceptable outcome.

Common examples include:

• creating a supplier and approving its payment;
• developing code and deploying it to production without independent review;
• requesting privileged access and approving the request;
• administering logs and deleting the evidence used to oversee administrators;
• creating a user and assigning sensitive roles;
• preparing and approving a risk acceptance;
• operating a backup process and being the sole person able to confirm restoration; and
• investigating an event in which the investigator’s own actions are in question.

A job title does not prove conflict. Two administrators may have different technical rights, while one finance role may accumulate several conflicting activities. Analyse permissions and process steps at the level where misuse could occur.

NIST defines separation of duty as preventing one user from having enough privilege to misuse a system alone. That definition is useful context; the organisation still chooses controls based on its own risk and operating model.

Build a conflict register

Document material conflicts in a maintained register. Each entry should include:

Field	Purpose
Process and systems	Shows where the conflict can arise
Conflicting activities	Defines the prohibited or restricted combination
Risk scenario	Explains the possible harm
Preventive control	Stops the combination or action
Detective control	Identifies activity that prevention may miss
Owner	Accepts accountability for the process
Exception authority	Approves justified deviations
Evidence	Shows design and continuing operation
Review trigger	Captures role, system and process change

Prioritise conflicts using risk. A small organisation may be unable to divide every task among different people. That does not remove the need to identify the conflict, reduce access where practical, create independent review and approve the residual risk.

The risk score calculator can support prioritisation when the organisation applies documented criteria consistently.

Choose the separation pattern

Different activities call for different patterns.

Sequential separation

Different people perform stages of one transaction. One person requests access, another approves it and the platform team implements it. The workflow should prevent self-approval and retain identities and timestamps.

Dual control

Two authorised people must act together for a sensitive operation. Examples include releasing a high-value payment or retrieving protected key material. Dual control is stronger than informal consultation because both actions are required and recorded.

Role and environment separation

Development, test and production responsibilities may be separated through roles, repositories, deployment gates and privileged accounts. Independence should exist in the actual path to production, not only in a procedure.

Custody and record separation

The person holding an asset should not be the sole person able to alter its accounting or monitoring record. This pattern applies to physical assets, cryptographic material, evidence repositories and financial records.

Independent monitoring

When staffing prevents full preventive separation, another competent person reviews activity using evidence the operator cannot alter. Review timing should match risk; an annual review is unlikely to compensate for powerful daily access.

Design prevention before detection

Preventive controls usually provide stronger assurance because they stop the conflict from being exercised. Use role design, incompatible-role rules, workflow gates, separate privileged accounts, protected branches, deployment approvals and transaction limits where appropriate.

Detection is still necessary. Systems change, emergency access is used, people move roles and configuration can drift. Useful detective measures include:

• incompatible-role reports;
• privileged activity monitoring;
• self-approval searches;
• emergency-change review;
• payment and supplier exception analytics;
• access recertification; and
• independent log review.

The access-control governance guide explains how ownership, approvals and recertification fit together.

Govern unavoidable conflicts

An exception should not become an informal permanent arrangement. Record:

1. the exact conflict;
2. why separation is not currently feasible;
3. the affected systems and activities;
4. compensating safeguards;
5. the accountable risk owner;
6. approval and expiry dates;
7. monitoring frequency;
8. review results; and
9. the plan to remove or redesign the conflict.

For a small payroll team, one person might prepare and submit a file while an independent manager reviews the source data, approved totals and bank confirmation. The compensating review must be timely, competent and based on evidence the preparer cannot control.

Avoid claiming that “management knows” is a control. Knowledge without a defined review, record and response threshold is not reliable operating evidence.

Connect people changes to access changes

Segregation design fails when an employee accumulates rights after promotions, transfers or temporary assignments. Joiner, mover and leaver processes should trigger conflict analysis, not only copy a colleague’s access.

Role owners should approve business need. System owners should confirm technical scope. Information security can define conflict rules and challenge high-risk combinations. Human resources or workforce systems should provide timely status changes. The RACI guide for ISO 27001 can help separate accountability from task execution.

Evidence implementation and operation

Implementation evidence may include the conflict register, role model, workflow configuration, access-control rules, exception process and assigned ownership.

Operating evidence should show that the design worked over time:

• sampled requests with independent approvals;
• system-enforced rejection of self-approval;
• periodic conflict reports and completed remediation;
• monitored emergency access;
• expired or renewed exceptions;
• mover reviews; and
• investigations of suspicious combinations.

A screenshot of a configured rule proves only one point in time. Auditors should also inspect settings directly where possible, obtain populations from source systems and trace exceptions to decisions.

Audit sampling that finds real conflicts

Begin with the complete role and account population. Select samples using risk rather than convenience.

Include:

• users with multiple sensitive roles;
• privileged and service accounts;
• recent movers;
• emergency or break-glass access;
• administrators who can alter logs;
• users involved in high-value transactions;
• exceptions near or past expiry; and
• changes to role definitions.

Test both directions. From a conflict rule, find users who hold the combination. From a sampled high-risk user, identify all rights across connected systems. A single-system review may miss a conflict split across identity, application and workflow platforms.

Pass, partial and fail examples

Pass: Material conflicts are defined, prevention is configured, exceptions are authorised and time-bound, monitoring covers the complete population, and findings are resolved.

Partial: A policy exists and some workflows block self-approval, but cross-system conflicts, mover access or exceptions are not consistently reviewed.

Fail: Powerful users can initiate and approve sensitive actions, monitoring evidence is controlled by the same users, or conflicts are accepted without risk ownership.

Keep control A.5.3 current

Segregation of duties changes whenever processes, systems, suppliers, staffing or privileges change. Review conflict rules during system implementation, role redesign, acquisition, outsourcing and significant incident analysis.

Use the Annex A Control Lookup for practical context on A.5.3 and related controls. Treat its guidance as a starting point; the organisation’s risk assessment and operating environment determine the final design.