What is the practice of ensuring that no organizational process can be completed by a single person; forces collusion as a means to reduce insider threats?

• A. Separation of Duties
• B. Shadow IT
• C. Stakeholder
• D. Vulnerability Management

Answer: (A)

Separation of duties is the practice of dividing responsibilities so that no single person can complete a critical process end-to-end. By splitting tasks among different individuals or roles, you create dual control and checks that prevent one person from having too much control. For a transaction to proceed, it typically requires at least two people—one to perform the action and another to review or approve it. This arrangement helps catch errors and detect fraudulent activity because actions are cross-checked and traceable. It also raises the bar for insider threats, since any wrongdoing would require collusion between two or more individuals, which is harder to carry out undetected. For example, the person who can modify financial records shouldn’t also be the one who authorizes payments. Other options don’t capture this dual-control principle and therefore aren’t the best fit.