ISO 27001 A.5.3: Separate Duties That Could Conceal a Failure

What A.5.3 requires in practice

Annex A control A.5.3 asks the organisation to keep conflicting duties and conflicting areas of responsibility apart. The idea is simple: when one person can start, approve and conceal the same activity, a mistake or deliberate misuse can pass unnoticed. Separation puts a second pair of eyes, or a second authority, between the action and its effect.

The control applies to duties and to wider areas of responsibility. A single task may need splitting, such as raising and approving a change. A broader area may need distance from another, such as the team that builds a service and the team that independently checks it. The organisation decides which combinations conflict in its own context.

The control does not demand a large headcount. Where a small team cannot separate every duty, the intent can be met by other arrangements that give comparable assurance, such as closer monitoring or independent review. The test is whether a conflict has been recognised and dealt with deliberately.

Identify the conflict before choosing the approval

Follow a sensitive action from request to execution and evidence. Identify who can initiate it, who can approve it, who can alter the system directly and who can change the record afterwards. Concentrate on combinations that could cause meaningful harm. Different job titles do not help when everyone shares the same powerful account.

Consider both error and intentional misuse. A developer reviewing their own release may miss a mistake even without malicious intent. A person maintaining records about their own administrative activity may be able to hide a breach of rules. The response should address the actual conflict rather than add an unrelated managerial signature.

Use separation that survives real operating conditions

Separation may involve different decision-makers, restricted permissions or an independent review before a consequential action takes effect. The appropriate arrangement depends on the service and risk. Reviewers need enough information and competence to challenge the action; a compulsory approval completed automatically becomes a delay without meaningful protection.

Test absence and emergency arrangements. A deputy may temporarily inherit roles that were deliberately separated. Define how urgent access is authorised, limited and subsequently examined. Emergency work should leave a clear trail so that temporary concentration of authority does not become the permanent operating method.

Small teams still need an accurate risk decision

When complete separation is impractical, identify the specific conflict and assess other measures. Supervision, protected logs or independent checks may reduce exposure, but their timing and independence matter. A review after an irreversible disclosure cannot prevent the original disclosure; it may offer detection and accountability only.

Document the rationale through the organisation’s risk and control arrangements, including limitations and the person authorised to accept residual risk. Do not describe a compensating check as equivalent merely because it is cheaper. Reconsider the arrangement when the team grows or new technology makes better separation possible.

Why segregation of duties matters to the business

Fraud, data theft and quiet errors thrive where one individual controls a whole chain, from request to approval to record. Separation makes such events harder, easier to detect and easier to investigate. It also protects accurate staff, because their work is visible and independently confirmed.

Customers and regulators in finance, outsourcing and healthcare routinely ask how privileged people are kept in check. A clear answer supports contracts and reduces the severity of audit findings. Where separation is impractical, showing that you understood the risk and compensated for it is far more credible than having no view at all.

How to implement A.5.3

Focus on the activities where one person acting alone could cause serious harm and nobody would notice. Proportion matters: a small team may tolerate more overlap than a payments function, so judge each area by the harm one person could cause.

1. List activities such as granting access, changing systems, approving payments and handling customer data, and mark where a single person can run the whole chain.
2. Decide which duty pairs conflict for your business, for example requesting and approving, developing and releasing, or administering and auditing.
3. Split those duties between different people or teams, and make systems enforce the split where they can.
4. Where headcount makes separation unrealistic, choose a compensating arrangement, such as independent review of the actions taken, and record why.
5. Check that role changes and temporary cover do not accidentally recreate a conflict.
6. Review the combinations periodically, particularly after reorganisations or new services.
7. Keep a brief note of the conflicts you accepted and the reasons, so a later reviewer can see the decision was deliberate.

Evidence an auditor expects for A.5.3

Common nonconformities with A.5.3

Findings tend to arise where separation exists on paper but is easily bypassed. Assessors often find the idea understood but not applied consistently across all teams and systems.

• One administrator can raise, approve and implement a change with no independent check.
• Role definitions allow conflicting permissions, often after someone moved between teams.
• Compensating review is claimed for a small team, but no record shows it actually happens.
• Approval samples show the requester approving their own request during busy periods.
• Duties are separated in the main application, but not in the supporting tools used by administrators.

Illustrative software example: production release authority

Illustrative manufacturing example: changing supplier details

A hypothetical manufacturer’s purchasing administrator can change a supplier’s payment contact and approve related information transfers. The same person also maintains the approval evidence. The business identifies the risk of an unauthorised redirection of sensitive financial information, even though the purchasing process has several named stages.

It assigns an independent check of consequential supplier-detail changes and restricts who can modify the relevant record. A later sample includes a rejected request and an urgent amendment, not only routine accepted changes. The test establishes whether the second person checked an independent source or merely repeated the original request.

Look beyond the visible workflow

Review role combinations in applications and supporting administration tools. Access-rights reviews should recognise conflicts that emerge when a person changes jobs or accumulates temporary permissions. A technically restricted approval screen may be bypassed through a database or configuration route.

Evidence can include identified conflicts, access configurations, approvals and records of independent checks. A segregation matrix is optional; demonstrable separation matters. Common failures include self-approval through a second account, reviewers lacking context, temporary privileges never removed and treating collusion as impossible. Sample actual capabilities as well as written roles, using authorised tests that do not disrupt production.