Segregation of Duties (SoD) is one of the most important internal controls in IT — and one of the most tested topics on the CISA exam. Here's everything you need to know.
What Is Segregation of Duties?
SoD ensures that no single individual has control over all phases of a process. The goal is to prevent fraud, errors, and unauthorized activities by requiring multiple people to complete critical tasks.
The Classic SoD Model
In any process, there are typically four functions that should be separated:
No one person should perform more than one of these functions for the same process.
IT-Specific SoD Conflicts
Development vs. Production
Developers should NOT have access to production systems. If they can deploy their own code, they could introduce unauthorized changes.
DBA vs. Security Administrator
DBAs manage databases; security admins manage access permissions. Combining these roles lets one person grant themselves unrestricted data access.
System Admin vs. User
System administrators should not be end-users processing business transactions on the systems they manage.
Change Management Conflicts
Common SoD Matrix
When SoD Isn't Possible
Small organizations often can't fully segregate all duties. In these cases, implement compensating controls:
How SoD Appears on the CISA Exam
Common question patterns:
Exam tip: When asked about the "greatest risk" of poor SoD, the answer almost always relates to the potential for fraud or unauthorized modification going undetected.
Practice SoD scenarios with our CISA Course — includes domain-specific quizzes and flashcards.