Segregation of Duties Management

Video Transcript This is a brief demonstration of ALLOut segregation of duties breach management using mitigating controls. With each segregation of duties conflict, there's an increased risk to company assets. It follows that these conflicts should be identified, avoided, and eliminated whenever it is reasonable to do so, but not all conflicts can be eliminated when that happens. Mitigating controls can help compensate for the risk. ALLOut enables you to document the mitigating controls directly in the system, making your SOD reporting process more efficient and more effective. Let's take a look. Everything we need can be found within ALLOut's access and audit reporting menu. In previous videos, we looked at how simple it is to define critical process lists and SOD rules and then run reports. Now let's incorporate mitigating controls into this process. This requires defining the controls themselves and then specifying what is being mitigated and who is being limited or affected by the controls. As you think about how mitigating controls fit into your organization's SOD reporting objectives, consider whether mitigation approval processes would also be helpful. If so, they can be configured here. That approval functionality is turned off by default, so if it doesn't fit your objectives, you can go straight to the mitigation definitions and assignments. We'll start with the control definitions. The grid layout makes it easy to enter the controls one by one or to upload them from the ALLOut SOD master. And if you've chosen to implement the optional approval process, you'll see that reflected here as well. Next, we'll associate the controls with the SOD rules. The mitigating controls can be included when the rules are initially created or added later. The next step is to assign the mitigating controls as appropriate. Controls can be assigned at the user, role, and star public level, and approval columns will be shown only if the mitigation assignment approval process has been activated. Mitigating controls can then be incorporated into the SOD reports. The interactive interface walks us through the report settings. This includes the option to filter based on mitigating controls. For this report, I chose to print the mitigating controls on the report, but there are other choices as well, including the option to hide mitigated breaches. For more detailed guidance on this and other ALLOut features, please visit the ALLOut Academy.