Key Controls and Segregation of Duties

What this video covers

• Why segregation of duties separates functions and supervision among departments, and what happens when control responsibilities concentrate in one person
• The three supervisory sins a firm's procedures must prohibit: self-supervision, reporting to a subordinate, and letting a subordinate determine compensation or continued employment
• The documented exception when firm size or position makes separation impossible, and why "never" is the wrong answer on the exam
• How designated principals establish, maintain, and enforce controls that test and verify whether written supervisory procedures are reasonably designed to achieve compliance
• The separate loops of control testing and corrective action, and why finding a loophole means rewriting the procedure rather than ignoring it
• What an information barrier controls (flow of information between departments) versus what an entitlement policy controls (which files and systems a single person may use)
• The distinction between access control (entry to a building, file, or system) and information access restriction (who may read the sensitive data once inside)