Segregation of duties: the control small teams think they cannot have

Segregation of duties means no single person can complete a sensitive process from start to finish without someone else being involved. It is one of the oldest controls in existence, it targets both fraud and error, and it is the control small organisations most often declare impossible - usually before considering the alternatives.

The combinations that matter

The risk is not a role; it is a combination of capabilities in one person. Classic examples:

• Request and approve. Raising a purchase, an access request or a change and approving it yourself.
• Develop and deploy to production. Writing code and pushing it live unreviewed - the reason self-merge is blocked in mature pipelines.
• Grant access and use it. An administrator who can provision themselves into a system and then operate in it.
• Operate and audit. Running a control and attesting that it works.
• Administer a system and administer its logs. If you can alter your own audit trail, the trail is not evidence.
• Create a vendor and approve payments to it. The classic finance fraud path.
• Manage keys and access the encrypted data. Encryption provides little insider protection if one person holds both.

Write these down as explicit "toxic combinations" for your environment. A list of forbidden pairings is far more usable than a policy sentence about least privilege, and it is testable.

Why it works

It addresses two different failure modes at once. Against fraud, it requires collusion rather than a single bad decision. Against error - which is far more common - it puts a second pair of eyes on consequential actions. The second benefit alone justifies it in organisations with no realistic insider threat.

When you genuinely are too small

Frameworks anticipate this. ISO 27001 explicitly acknowledges that segregation may be difficult in small organisations and expects compensating controls rather than pretending. What actually compensates:

• Detective review. Someone independent reviews what was done after the fact - a monthly review of privileged actions, changes or payments. Detection instead of prevention.
• Enhanced logging with protected trails. The person acting cannot alter the record of it.
• Automated alerting on the sensitive combination being exercised.
• Cross-functional review. Finance reviews IT's privileged actions; the engineering lead reviews finance system access. Neither needs domain expertise to spot anomalies in a short list.
• External review - an accountant, an advisor, or a board member sampling periodically.
• Dual authorisation for the highest-consequence actions only, even if everything else is single-person.

Document the constraint, the compensating control and who accepted the residual risk. That combination is auditable; silence is not.

What auditors test

• A documented list of incompatible duties for your context.
• Evidence that the combinations are not held by one person - typically an access export analysed for conflicts.
• For accepted conflicts: the documented compensating control and evidence it operates.
• Change records showing author and approver are different people.
• Access reviews that consider conflicting entitlements, not just excess ones.

That last point is commonly missed. Most access reviews ask "does this person still need this?" but not "does this person now hold two things that conflict?" - which is exactly what accumulates through internal transfers.

Emergency access

Break-glass procedures intentionally bypass segregation, which is correct - but they need the corresponding controls: alerting on use, mandatory post-use review by someone else, and a time limit. An emergency path with no review is simply a permanent bypass with a polite name.

Key takeaways

• The risk is a combination of capabilities, not a job title.
• Write an explicit toxic combinations list - it is testable, unlike a policy sentence.
• Small teams use detective compensating controls, documented and accepted.
• Access reviews should look for conflicting entitlements, not just excessive ones.