Which concept involves dividing duties to reduce fraud risk?

Which concept involves dividing duties to reduce fraud risk?

• A. Access Control List (ACL)
• B. Capability List
• C. Need-to-Know Principle
• D. Separation of Duties

Answer: (D)

Separating duties means dividing responsibilities so no single person controls all parts of a critical process. This creates checks and balances that make fraud or errors much harder to conceal, because different steps require different people and their actions can be cross-checked. For example, the person who initiates a payment should not be the one who approves it or records the transaction, and someone else should reconcile the accounts. This division builds an audit trail and encourages oversight, making it easier to detect unusual activity. Access Control Lists and Capability Lists specify what a user or process is allowed to do, but they don’t inherently mandate who performs each step of a workflow. The Need-to-Know Principle limits who can access information based on necessity, yet it doesn’t enforce the separation of duties across tasks. Separation of Duties specifically targets distributing tasks to reduce fraud risk, and it is most effective when combined with appropriate access controls to support those roles and chores.

Separating duties means dividing responsibilities so no single person controls all parts of a critical process. This creates checks and balances that make fraud or errors much harder to conceal, because different steps require different people and their actions can be cross-checked. For example, the person who initiates a payment should not be the one who approves it or records the transaction, and someone else should reconcile the accounts. This division builds an audit trail and encourages oversight, making it easier to detect unusual activity.

Access Control Lists and Capability Lists specify what a user or process is allowed to do, but they don’t inherently mandate who performs each step of a workflow. The Need-to-Know Principle limits who can access information based on necessity, yet it doesn’t enforce the separation of duties across tasks. Separation of Duties specifically targets distributing tasks to reduce fraud risk, and it is most effective when combined with appropriate access controls to support those roles and chores.