What is the concept of separation of duties and provide an example?

• A. Split responsibilities to reduce fraud and errors. Example: code development, testing, and production deployment are performed by different roles.
• B. Merge all roles to speed delivery.
• C. Remove checks to speed.
• D. Only one person handles all security tasks.

Answer: (A)

Separation of duties is a control designed to reduce the risk of fraud and mistakes by ensuring no single person controls all aspects of a critical process. By dividing responsibilities, errors or intentional misuse can be caught through independent checks.

In software development, this is typically shown by keeping code creation, testing, and production deployment in separate hands. For example, one person writes the code, another reviews or tests it, and a different releases it to production, often with formal approvals and change logs. This separation creates checks and balances, making it harder for someone to slip in bad code or go unnoticed. It’s reinforced by access controls and least-privilege practices so each role has only the permissions needed to do its part. The other options would undermine this control by concentrating power, removing checks, or letting a single person handle everything.