How to Maintain Segregation of Duties with a Small IT Team 

Segregation of duties means no single person controls every step of a critical process, such as requesting, approving, and carrying out a system change. For community banks and credit unions with lean IT and operations teams, it is one of the hardest controls to sustain day to day. 

When access, approvals, and review responsibilities drift together over time, the result can be a repeat examination concern, an internal audit finding, or a board-level question about oversight. Most institutions document segregation of duties in policy. Keeping that documentation accurate as people and systems change is where programs tend to slip. 

Where Segregation of Duties Conflicts Show Up at Smaller Institutions 

Small teams make overlap common, and most conflicts start as a practical necessity. Overlap like this is often unavoidable, and it still needs to be identified, documented, and independently reviewed. The conflicts we see most often include:

• A network administrator who manages the firewall and approves their own firewall change requests 

• An IT staff member who can request, approve, and deploy system changes without a second reviewer 

• A core system administrator who also holds rights to process transactions 

• An administrator responsible for reviewing the audit logs that record their own activity 

• An information security officer who also runs day-to-day IT operations 

Shared administrator accounts make each of these harder to manage, because the institution cannot show who made a given change. Our post on rogue service accounts covers a related blind spot in account ownership.

What the FFIEC Expects When Duties Overlap 

The FFIEC IT Examination Handbook recognizes that full segregation of duties is not always feasible at smaller institutions. Examiners expect management to know where full segregation is not practical. Management should identify and understand the resulting risks and implement appropriate compensating controls, such as rotation of duties, independent monitoring, supervisory review, or activity-log review. 

Compensating controls are additional safeguards that reduce the risk created by a conflict. Common examples include independent review, dual approval, and audit logging that someone other than the process owner reviews.

How to Document Compensating Controls

Strong documentation answers the questions an examiner or internal auditor will ask about each conflict. For every overlap, record: 

• The conflict: the person or role and the duties that overlap 

• The reason: why separation is not feasible today, such as staffing or system limitations 

• The compensating control: what reduces the risk, such as a second approver or an independent log review 

• The reviewer: who performs the control, independent of the process owner 

• The frequency: how often the control runs 

• The evidence: the record that shows the control happened, such as signed change tickets or log review signoffs 

For most institutions, a conflict matrix maintained in a spreadsheet is enough, as long as it stays current, and the evidence behind it is retained.

How to Keep Segregation of Duties Current 

Most institutions can name their segregation of duties conflicts when asked. The harder part is the ongoing maintenance behind that answer: 

• Mapping duties as roles and systems change 

• Documenting where conflicts sit and why 

• Designing and testing compensating controls 

• Revisiting the full picture as the organization grows, restructures, or adds new systems 

This work rarely shows up on an org chart, which is why it often gets done once for an audit and then left alone until the next one. Tying a review to known triggers, such as a staffing change, a new system, or the annual risk assessment, keeps the picture from going stale.

Who Should Own Segregation of Duties? 

Segregation of duties works best when someone outside the day-to-day process owns it. At institutions without a full-time security executive, a virtual CISO can fill that role. A vCISO can review access patterns, evaluate compensating controls, coordinate with management and internal audit, support examiner conversations, and keep the control environment aligned as roles, systems, and processes change. 

Get Support for Your Control Environment 

If your institution relies on the next audit to surface segregation of duties gaps, it may be time for a closer look. CyberAssurance’s Virtual CISO services help community banks and credit unions map where duties overlap, put the right compensating controls in place, and keep that work current as the organization changes. Contact CyberAssurance to talk through what that looks like for your institution.