What it means
The control can separate request from approval, development from production release, payment creation from authorization, or investigation from evidence custody. The exact split depends on the risk and available staffing.
Why it matters
Dividing authority reduces fraud, error, abuse, and the chance that one compromised account can complete an entire harmful workflow.
Practical focus
- Identify transactions where one person has end-to-end power
- Separate approval from execution where practical
- Monitor emergency and break-glass exceptions
- Review conflicting roles after job changes
Common mistakes
- Creating ceremonial approvals with no real review
- Ignoring small teams that need compensating controls
- Allowing emergency access to become normal access
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: