MENU
Is this a valid scenario where a Separation of Duties policy should be used?
Proposed Solution / Statement: A user requests a major system configuration and approves the change.
Does this proposed solution meet the requirement / solve the scenario?
Yes. This is a classic Separation of Duties scenario. The individual requesting a significant system configuration change should not also possess the authority to independently approve that same change. Combining requester and approver responsibilities eliminates an important independent-control checkpoint and allows one person to initiate and authorize a potentially high-impact administrative operation.
SailPoint's official SoD guidance specifically uses major system configuration changes as an example: significant configuration changes should be approved by someone other than the person requesting the change. SoD policies are designed to identify and govern combinations of access that would enable such conflicting responsibilities.
From a governance perspective, the requester initiates the business or technical need, while an independent reviewer determines whether the requested change is appropriate, authorized, and sufficiently controlled. Separating these functions reduces fraud, accidental misconfiguration, privilege abuse, and unauthorized system modification. Where conflicting access already exists, Identity Security Cloud can identify the associated SoD violation for investigation and remediation.
Therefore, allowing the requester to approve their own major system change represents exactly the type of control conflict that SoD is intended to prevent.
Study Guide Reference: Supporting Governance --- Separation of Duties, Requester/Approver Conflicts, Internal Controls and SoD Policy Enforcement.
===============