AL Refs: CHM07, VMN04, ACL20
Purpose
Segregation of duties is a key control activity that ensures at least two individuals are involved in every code change. This mitigates the risk of error, inappropriate changes (eg. Rogue developer) and helps ensure the formal change control processes are followed. There are four main methods used:
- Systematically enforced peer review of code changes (example below);
- Systematically enforced approval of releases prior to deployment;
- Complete segregation of developer and operations roles including the access so developers cannot release to production;
- Configured alerts for code changes and deployments to ensure adequate oversight.
That last method is generally a last resort for small organisations where the other three are not feasible.
Example Evidence
Github
