ESG disclosure & reporting8 min read

Segregation of duties in Intelex: the assurance trap

Segregation of duties is one control with one sentence behind it: the person who prepares a figure must not be the person who approves it. Every assurance conversation about reported data eventually reduces to that sentence, and most organizations believe they have satisfied it because they built an approval workflow.

An approval workflow is not the control. It is the place the control has to live, which is a different claim. We have tested this directly in a configured environment, and the result is worth stating without hedging: stage security and field-level permissions are each, on their own, insufficient. Either one alone leaves the control broken in a way that a normal test will not reveal.

What stage security actually does

Stage security governs who may act on a workflow stage. By default it resolves to the person responsible for the stage plus that person's supervisor. Anyone else needs an explicit custom permission before they can complete the stage.