BestPracticestoresolveSegregationofDuties-Isaca.docVIP

Best Practices to resolve Segregation of Duties conflicts in any ERP environment It is a well known fact that Segregation of Duties (SOD) is a top contributor for fraud activities and is a key part of achieving Sarbanes Oxley (SOX) Compliance. The challenge of achieving this is typically more acute in the small and medium sized companies due to the lack of advanced tools or the expertise to manage this risk effectively. Hence, in this article, I have compiled a list of activities, which when combined together pose a high risk to the business. Internal Audit would need to work collaboratively with the business and the IT teams to Segregate these duties wherever possible and assign an appropriate mitigation control in cases wherein it is not feasible to do so. In addition, these controls would need to be monitored on a quarterly basis and the results need to be reported to senior management. SOD Assessment and Remediation Process The initiative to determine, analyze and address SOD issues can be achieved by the following three steps: Phase I: Gather a list of applicable SOD conflicts Use the conflicts listed below as a guideline or a starting point, but do interlock with the business to create a subset of the conflicts that would be applicable in your company’s environment. This can be achieved as follows: Identify key responsibilities for each business process area Define Segregation of Duties rules Create a SOD matrix from these rules Phase II: Analyze SOD Output This can be performed manually or with the help of a tool. In case of manual analysis, for each user, analyze if he/she has the access to perform any of the conflicting functions defined in Phase I. In case of using a tool, proceed as follows: Upload Segregation of duties to the SOD tool Execute the SOD tool Perform SOD Conflict Analysis Phase III: Remediate and Remain Clean phase In this phase, evaluate if the conflicting tasks can be performed by an alternate person. If so, work with the IT team to modify