Question

In many organizations, responsibility for testing Segregation of Duties is relegated to the IT auditor. The reasoning behind this assignment correlates SOD controls to logical system access.

-If you were an IT Auditor in an organization, what type of business risks would you consider? (3 examples)

-What type of control mechanisms would you put in place for more efficient audit procedures.

Explain its relevance from every perspective.

Answer 1

Segregation of Duties (SOD) is an important aspect for a companies Risk assessment mechanism. There are many business processes and every business processes will have SOD risk associated with the way the activities are conducted. A simple SOD risk can be a separation of Vendor invoice processing function from payment processing function. Because if a person processing an invoice is also making payment then he can process a fake invoice and make payment for himself and there is a risk of fraud here which is called SOD risk. Now let us understand how the SOD risk is associated in IT systems. The processing of Invoice and payment processing happens in system. What can be done in system is the person having access to process invoice should not have system access to make payment process for the same Invoice. The payment processing access should be with some one else who will not have access to process invoice. The second SOD risk is the person who has access to pass cash disbursement entries in books should not have access to disburse amount from bank accounts. If he has both the accesses then there is high risk of cash stealing. The third SOD risk is the person ordering material should not be responsible to receipt the goods after verifying whether all the goods are in correct quantity and quality. It may happen that though there was less quantity is received the person may pass inventory receipt for full quantity and rest of it he may take away when received. So there should be an independent person responsible to verify and receipt goods in the system.

The effective control procedure as an IT auditor that I would put is record an audit trail of who did what activities in the system and for sample transactions i would test whether there is no SOD risk based on the transactions performed.

The main control i would implement is at the time of assigning access rights, I would ensure that access right library be created in system which will include the conflict of accesses. Like Payment processing access should conflict with invoice processing access. This conflicts are set in the system and when assigning the system prevents it to be assigned to the same person.