What evidence do auditors commonly ask for on 5.3 Segregation of duties?

A segregation of duties matrix identifying which conflicting duties the organization has chosen to separate; Role definitions and a role conflict ruleset in the identity or ERP system; Output of automated or periodic conflict analysis and records of conflicts removed; Change and access request records showing requester, approver and implementer are different people; Where separation is impractical, documented compensating controls such as activity monitoring, audit trail review and supervisory sign-off; Evidence that collusion scenarios were considered when designing the separation.

What is the most common gap auditors find on 5.3?

Developers retain standing write access to production

ISO/IEC 27002:2022 · Organizational controls

`5.3` Segregation of duties

Duties and areas of responsibility that conflict with each other are to be kept apart. Purpose: cut the chance of fraud, mistakes and circumvention of security controls. Guidance: the aim is that no single person can carry out conflicting steps on their own, so the organization decides which duties need separating. Typical candidates are raising, authorizing and carrying out a change; requesting, authorizing and provisioning access; designing, writing and reviewing code; building software versus running production; using an application versus administering it or its database; and designing security controls versus auditing and assuring them. Collusion should be factored into the design. Where the organization is small and full separation is not realistic, the principle is still applied as far as practical and compensating measures such as activity monitoring, audit trails and management oversight are used. With role-based access control, care is needed so nobody receives conflicting roles; large role sets may call for automated conflict detection and cleanup, and roles should be defined so that removing or reassigning one does not cause access problems.

Source: ISO/IEC 27002:2022, 5.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

easy

to go live

Identity provider / directory

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Role definitions and a role conflict ruleset in the identity or ERP system · Identity provider / directory
Output of automated or periodic conflict analysis and records of conflicts removed · Document repository
Change and access request records showing requester, approver and implementer are different people · Identity provider / directory

periodic reviewEvidence produced at each review

Where separation is impractical, documented compensating controls such as activity monitoring, audit trail review and supervisory sign-off · SIEM / log platform
Evidence that collusion scenarios were considered when designing the separation · Document repository

governing documentDocuments that govern the control

A segregation of duties matrix identifying which conflicting duties the organization has chosen to separate · Policy repository / GRC workspace

First move

Automate the pull from your Identity provider / directory. Scheduled export of users, roles and MFA state from the directory; access-review completion pulled from the IdP, not a spreadsheet.

Common gaps auditors find

Developers retain standing write access to production
Conflict rules exist on paper but are not enforced in the access management tooling
Small teams claim segregation is impossible and record no compensating control
Role reassignments leave individuals holding both old and new conflicting roles

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

5.2 Information security roles and responsibilities · 5.4 Management responsibilities