Segregation of Duties (SoD)
Segregation of Duties (SoD) reduces the risk of errors, conflicts of interest, and unchecked decisions by ensuring that critical ISMS activities are not owned and approved by the same person.
Why SoD matters in an ISMS
ISO 27001 expects defined roles, accountability, and independent oversight for key ISMS activities. When responsibilities overlap, the organization must recognize the governance risk and demonstrate how it is managed.
Our current situation
As a small organization, the person implementing the ISMS is also part of top management and performs the management review. This creates a segregation-of-duties risk because design, execution, and review are not fully independent.
Risk treatment approach
We treat this as a documented and accepted risk in our risk register. Given our current size and resources, we accept this limitation while implementing compensating controls and planning future mitigation as we grow.
Compensating controls
Formal management review process with structured agenda and documented outputs
Explicit documentation of the conflict and rationale for acceptance
Planned mitigations
Hiring and team expansion to separate governance and execution roles
Delegation of control ownership where feasible
External input or periodic independent review to reduce bias
When SoD is limited, transparency matters: the risk, rationale, and mitigation plan must be explicitly documented.
Evidence we maintain
Risk register entry for SoD risk (status, owner, treatment plan, acceptance rationale)
Management review records showing acknowledgment and follow-up actions
Documentation of any external input or independent checks performed