Key takeaways
- Split conflicting tasks so one person cannot both do and approve something risky.
- If one person can request, approve and execute a sensitive action alone, errors and fraud go unnoticed.
- Start here: identify conflicting duties, for example raising and approving payments, or writing and deploying code.
Purpose
Split conflicting tasks so one person cannot both do and approve something risky.
Requirement
Requirement summaryConflicting duties and conflicting areas of responsibility shall be segregated.
Why it matters
If one person can request, approve and execute a sensitive action alone, errors and fraud go unnoticed. Splitting duties adds a natural check.
How to implement
- Identify conflicting duties, for example raising and approving payments, or writing and deploying code.
- Separate those duties between people or systems wherever practical.
- Where the team is too small, add compensating controls such as peer review, logging and management sign-off.
- Review role assignments periodically to catch drift.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your access control policy, stating that conflicting tasks are split between different people (segregation of duties).
- A simple table showing which tasks must not be done by the same person, such as requesting and approving a payment.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.3 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A few recent payments, changes or user setups showing one person asked and a different person approved.
- A list of who has access to sensitive processes, showing no one person can do everything alone.
Things you should be able to show or explain
- Be able to show how your systems stop someone from approving their own request.
How much to show: A handful of recent high-risk payments or changes.
Common mistakes
- One administrator can request, approve and release their own changes.
- The rule exists on paper but systems don't enforce it.
- Admins who can grant themselves access and approve their own changes.
- No documented compensating controls when separation is impossible.
- Tip: In small teams, use peer review and logging as a compensating control.
Policies & documents to have
- Human Resource Security Policy
FAQ
Is A.5.3 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.3?
Be ready to explain how the control works in your organisation and to provide things like: Your access control policy, stating that conflicting tasks are split between different people (segregation of duties)…