9.2 Segregation of Duties Query - Campus Solutions
Purpose: Use this document as a reference for running and reviewing the segregation of duties query in ctcLink
Audience: College Local Security Administrators
You must have at least one of these local college managed security roles:
- ZD_DS_QRY_SECURITY_TABLES
If you need assistance with the above security roles, please contact your local college supervisor or IT Admin to request role access.
Segregation of Duties
When talking about Segregation of Duties, it is important to understand the risk areas within the application and understand what security roles compromise the access to those areas. When conflicts are identified, users’ access must be adjusted where possible to remove offending roles. When this is not possible due to resource constraints, mitigating controls must be put into place. These can be Log reviews, rotating personnel, reconciliations, etc. that occur to monitor the data and transactions for any potential fraud or misuse. Reports can be run to validate the data or transactions, or some review of audit records where applicable. Compensating controls can be preventative, detective, or monitoring controls that are executed by an independent supervisory-level employee. There MUST be an audit trail for each compensating control.
It is recommended that the Schedule Query option be used for larger queries. Please see the following QRG for instructions to run the query:
Running Large Results Queries (Schedule Query)
The query name is: QCS_SEC_SEGREGATION_OF_DUTIES
The query prompts are for Institution and optionally for User ID.
A supplemental query QCS_SEC_SEGREGATION_DRILLDOWN can be used to view role conflicts.
Running the Segregation of Duties query, at least twice yearly, helps to confirm that role assignments and authorization levels are correct, to mitigate access risks, and to ensure audit readiness.
0 Comments
Add your comment