Separation of Duties at Riordan Manufacturing

James Shoemaker
CMGT 430
August 20, 2012
Bradley Andrews

Separation of Duties at Riordan Manufacturing
Identifying and managing risk is a key to the survival of every organization that has more than one or two people involved in the day-to-day activities. Anytime that an organization allows an opportunity for a single user to perform more than one task or function that requires checks and balances the opportunity for loss to the organization exists. The proper management of risk by the organization will at the very least minimize financial losses to the company and in most cases increase profits.
A review of the current processed in place at Riordan Manufacturing’s different locations has led to the recommendation that Riordan Manufacturing needs to establish new policies that provide for Separation of duties within the different departments of the organization. By definition, separation of duties is a key concept of internal controls and is the most difficult and sometimes the most costly one to achieve. This objective is achieved by disseminating the tasks and associated privileges for a specific security process among multiple people (Coleman, 2008).
Separation of duty, as it relates to security, has two primary objectives. The first is the prevention of conflict of interest, the appearance of conflict of interest, wrongful acts, fraud, abuse, and errors. The second is the detection of control failures that include security breaches, information theft, and circumvention of security controls (Coleman, 2008).
By establishing separation of duties policies at Riordan Manufacturing the organization will be able to reduce and possibly eliminate the possibility of loss to the organization resulting from employee theft or processing errors.
Examples of where separation of duties must be implemented immediately at Riordan Manufacturing include cash receipt processing, inventory receiving, and order entry and fulfillment. There are also opportunities in the information technology areas of the organization in which the same employees are responsible for developing and deploying applications and updates and the setup of computer workstations and user access.
Computerized controls must be considered as a component of the implementation of separation of duties policies at Riordan Manufacturing
Implementation of the Policy
The first step in the implementation of the new separation of duties policy will be to identify the roles and responsibilities associates with all of the Riordan employees that will be accessing the organizations information managements systems. This includes all users, from the CEO to the inventory clerks, event the janitorial staff if they need to access the organizations computers systems for any reason. Once the roles and responsibilities are defined all systems users must be assigned to security groups associated with their roles, for example, developers, DBAs, Accounts Receivables clerks, accountants, etc. This is necessary in order ensure that no one individual has the responsibility or ability to perform both the checks and balance portions of the systems updates and transaction processes that could result in risk of loss to the organization.
In addition to supporting the separation of duties and improving the overall security of the organizations computerized applications RBAC can significantly reduce the cost of user management. RBAC and separation of duties will also significantly reduce possibilities of employee theft and unrecognized user errors that can lead to financial losses to the organization.
The following are examples of where the implementation of RBAC and separation of duties could benefit the organization.
Cash Receipt Processing
Currently the person responsible for processing cash receipts is the same person responsible for confirming that the monthly bank statement accurately reflects all cash receipts received. This person is also responsible for the handling of cash payments and the preparation of the bank deposits for the cash receipts.
By separating the roles of the person receiving the cash receipts and the person preparing the deposit tickets the possibility of an error due to theft or human error will occur because one role checks the other. There is still a possibility for collusion by the two employees; this will be addressed by having the monthly checking account balancing done by another employee that has no connection to the employees performing the daily activities.
Inventory Receiving
When inventory is received the same employee who unloads the product enters the receipt into the organizations inventory control system. This can result in over or understated inventory if the employee makes an error in counting or entering the quantities of each items into the system. These errors can be either accidental or intentional if the employee believes that they can profit from recording less than the amount actually received and disposing of the difference by selling it to others or taking it home for personal use.
By separating the duties into two roles, the receiving employee and the inventory clerk it is possible to introduce the necessary checks and balances. This results in the receiving employee unloading and counting the product and then handing off the inventory receipt to the inventory clerk who verifies the inventory counts and enters the transaction into the inventory control system.
Accounts Payable
The current process for accounts payable is handled by a single person who is responsible for entering invoices received into the accounts payable system and the preparation of the weekly check runs to pay the organizations vendors. This one person process can result in loss to the company if the employee decides to create payments to non-existent vendors possibly double pay invoices to vendors who offer a kick back for such activities or if the employee simply makes a mistake that results in an overpayment of an invoice.
By separating the roles of the accounts payable clerk into two roles where one employee receives and posts the invoices and a second who is responsible for preparing the payables check run and validating the invoices that will be paid. This eliminates the possibility of loss to the company unless the two employees work together to falsify the information related to the payables processing. By implementing an auditing function similar to that described in the cash receipts section above the organization can easily identify this type of activity before a significant loss to the organization can occur.
Application development and deployment
An area often overlooked by smaller organizations is the application development an deployment function. In many cases this group is made of a small number for employees who are responsible for the development and deployment of applications and updates to the organizations different applications. While this group is less likely to generate a loss to the company by stealing products or financial assets it is possible that an application update could be deployed that was not properly tested and result in data errors or system downtime that can have significant financial impact to the company. This type of activity normally happens when there is pressure to release new updates with extremely tight timelines.
By separating the roles so that the application developer is a different employee that the person who performs the application testing and deployment the organization can minimize the possibility that untested application changes are implemented. Proper testing minimizes the possibility of data and systems failures that could result from bypassing the testing phase.
User Maintenance
The current security model allow for any system user to modify user access rules that apply to the areas of the organization that they are responsible for. This model allows for any manager to open the organization up to potential losses by accidentally granting access to users and thereby allowing access to functions that should be restricted. If an error goes unidentified for a period of time significant financial losses to the organization could result either intentionally or accidentally.
Separation of duties would result in ensuring that user maintenance is restricted to the systems administrator and designated backup in order to minimize the possibility of errors in the process of user authorization to the different applications used within the organization.
Conclusion
The examples show above clearly show how the creation and implementation of a policy that requires the separation of duties for all users of Riordan Manufacturing’s information systems can have an immediate impact on the security and financial profitability of the organization. The examples listed may give the impression that there is a recommendation to create additional positions within the organizations but this is not the case. It will be necessary to redefine some of the job descriptions so that the responsibilities of the employees fit the new roles that are identified for the RBAC of the organizations computer systems. As an example the employees that currently process cash receipts and accounts can be re-tasked to provide the checks and balances for each other while an account or other employee not related to the two tasks perform the check book reconciliation. It is the recommendation of Smith Systems consulting that Riordan Manufacturing should begin the process of defining the roles needed to implement RBAC to all of the organizations computerized applications immediately. This information should then be used to develop and implement a separation of duties policy for the organization at the earliest possible time. References
John Gregg, Michael Nam, Stephen Northcutt and Mason Pokladnik, May 5th, 2012, Separation of Duties in Information Technology, Retrieved from: http://www.sans.edu/research/security-laboratory/article/it-separation-duties
Kevin Coleman, Technolytics Institute, August 26,2008, Separation of Duties and IT Security, Retrieved from: http://www.csoonline.com/article/446017/separation-of-duties-and-it-security

Trey Guerin and Richard Lord, November 6, 2003 How role-based access control can provide security and business benefits, Retrieved from: http://www.computerworld.com/s/article/86699/How_role_based_access_control_can_provide_security_and_business_benefits