This report begins with a review of segregation of duties and sensitive access controls, and reasons why both subjects are often misunderstood by the audit and compliance community. It then offers an 11-step method for assessing business processes to find gaps where SoD and SA controls are necessary, establishing those ...