Governance, Risk, and Compliance Handbook: Technology, Finance, Environmental, and International Guidance and Best Practices

CHAPTER 21

AUTOMATION OF SEGREGATION OF DUTIES

Lindsey Kudo

21.1 INTRODUCTION

21.2 DEFINING SEGREGATION OF DUTIES

21.3 LOOKING TOWARD AUTOMATION

21.4 AUTOMATING SEGREGATION OF DUTIES

21.5 SEGREGATION OF DUTIES CONSIDERATION CHECKLIST

21.6 TYPES OF AUTOMATION TOOLS

21.7 SOD VIOLATION REPORTING CAPABILITIES

21.8 SOD SIMULATION CAPABILITIES

21.9 PREVENTIVE CONTROLS

21.10 SOD RISK LIBRARIES

21.11 IMPLEMENTING A SOD AUTOMATION TOOL

21.12 POSTIMPLEMENTATION SUPPORT

21.1 INTRODUCTION

Since the Sarbanes-Oxley Act of 2002 (SOX), public companies are now investing time and resources to ensure that effective internal controls are put in place throughout their organization to aid in creating a "new era of corporate accountability and responsibility." While years 1 and 2 of SOX concentrated on documenting key business processes, risks, and controls, the new area of focus by internal and external auditors is segregation of duties (SOD). Segregation of duties is by no means a new concept to the business world; however, the internal controls requirements mandated by Section 404 of SOX have placed a renewed interest in this subject matter. Segregation of duties is a key internal control for any organization to have in place, but also one of the most difficult and resource intensive to achieve.

As companies start to automate their SOX efforts, chief information officers and internal audit departments are evaluating many of these software solutions based on the preventive and detective SOD capabilities. ...