FFIEC IT Examination Handbook IS-II.C.7(c): II.C.7(c) Segregation of Duties (Information Security)

Management designs jobs so that more than one person is needed to complete critical or sensitive tasks, evaluates who is granted system administrator privileges and monitors their activity, monitors privileged users independently, distributes administration so that no administrator can hide activity or control an entire system, adds approval levels as decisions grow more critical, and requires an independent review such as audit of any activity performed without adequate segregation.