Page 142 - CISSO_Prep_ Guide

part. An example of this is processing expense forms. An
employee can submit an expense form, but it must be reviewed
and approved by another person before payment. In many cases,
even the payment process is further subdivided into that another
person must sign the check or initial the cash disbursement.
Separation of duties is used to prevent and detect fraudulent
activity, or to catch errors before they are submitted into
production.

Mutual Exclusivity
Mutual exclusivity is closely linked to the separation of duties.
When a transaction is divided into several separate tasks. Each
task must be executed by a different person. One person mustn't
just do each task, thereby circumventing the separation of duties.

In many cases, a person may have the right to submit work,
authorize the work of others, and perhaps even correct errors.
But even though any one person has the rights to both submit
and approve those two tasks are mutually exclusive. If they
submitted the data, then they would not be allowed to approve it.
If they approved the work of someone else, they would not be
able to correct any errors. This can prevent fraud and also help
ensure that any errors are detected by having someone else
review the work of their peers or subordinates.

Dual Control
Dual control is the real-time practice of implementing separation
of duties. Whereas mutual exclusivity implements separation of
duties by having different people involved in a sequential series