Are the Duties Separated?

About this interactive

Separation of duties splits a sensitive process so that no single person can carry it through alone. The Separation of Duties lesson's purchasing process has steps: choose a vendor and product, create the purchase order, approve it, cut the check. If one person can do them all, that person can buy something for themselves on the company's money, as in the lesson's story of a contractor hired to work on an employee's house. Put the approval with a boss, who asks why the company is paying a construction firm, and the check with accounting, and each step checks the one before. That is the checks and balances. The lesson applies the same idea to access: a person submits a request, the resource owner approves it, and then someone implements it. The documents are a paper trail: if access turns up with no request or approval behind it, you can see a step was skipped. The lesson also notes a common compromise: below a set spending threshold, a manager may approve their own purchases, with someone else still cutting the checks and audits checking later. No card here turns on a threshold. A quick test for each card: can one person get from the start of the process to the money or the access with nobody else acting?

What you'll learn

Judge whether a process separates duties, so that no one person can carry a sensitive transaction through alone, or lets one person complete it
Apply separation of duties to purchasing (choose, order, approve, pay) and to access (request, owner approval, grant), where a second person's step is the check and the record is the paper trail

Aligned to

ISC2 CISSP

7.4 Apply foundational security operations concepts

NIST 800-53

AC-5 Separation of Duties

NIST CSF

PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.

Key terms

Separation of Duties: Separation of Duties is a security control principle requiring that critical or sensitive tasks be divided among multiple individuals to prevent fraud, collusion, and unauthorized actions by any single person.
Checks and Balances: A system of controls in which multiple individuals or steps are required to complete a process, reducing the risk of fraud or error by ensuring mutual oversight.
Fraud: Intentional deception or misrepresentation carried out for financial gain, such as embezzlement or falsifying records.

Topics

Personnel Security Separation Of Duties Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →