You do not need a large department for every task. You do need to address situations where one person could make an important mistake or misuse access without anyone noticing.
Separating incompatible duties is one way to do that. The AICPA’s SOC 2 criteria also recognize alternative controls where separation is not practical. Being a small company is a reason to design a workable approach, not to ignore the risk.
Find the conflict before choosing a reviewer
Consider an administrator who can grant themselves powerful access and remove the records of what they did. Assigning a second job title to that same person does not resolve the conflict.
Ask what could go wrong and what would stop it or reveal it in time. Focus first on actions that could materially affect customer data or the service.
Choose a safeguard that addresses the actual problem
Depending on the activity, options to assess may include:
- A second qualified person approving a sensitive action before it happens.
- Limiting what the person can do without additional authorization.
- Sending activity records somewhere the person cannot alter them.
- Having a capable reviewer examine changes and investigate unexplained activity.
These are examples to evaluate, not interchangeable fixes. A review after the event may be too late for some actions. A reviewer also needs enough knowledge to recognize a problem and enough authority to get it corrected.
Avoid approval theater
A founder clicking “approved” without understanding the change adds little protection. Automated tests can help check expected behavior, but they do not necessarily establish that a change was authorized or appropriate.
If nobody on staff can perform a meaningful review, consider qualified outside help or redesigning the workflow. Do not describe independent review in your policy if nobody actually performs it.
Show how the arrangement works
Keep a short explanation of the conflict and the chosen safeguards. Retain evidence that the safeguards operated. Record problems found and how they were resolved.
Discuss the design with your auditor early. Management remains responsible for the controls; an early conversation is not a guarantee of an audit outcome.
Revisit the arrangement as the team grows. A temporary workaround should not become permanent simply because everyone forgot why it existed.
Source
AICPA Trust Services Criteria: the segregation-of-duties point of focus under CC5.1 and access considerations under CC6.3.
One Response