Which control category is described as Divide responsibilities among multiple employees to restrict the amount of power or influence held by any individual?

Which control category is described as Divide responsibilities among multiple employees to restrict the amount of power or influence held by any individual?

• A. Separation and rotation of duties
• B. Least privileges
• C. Detection Controls
• D. Controlled access

Answer: (C)

Dividing responsibilities among multiple people to limit any single individual's power is separation of duties, often paired with job rotation. By splitting the key steps of a process—such as initiation, approval, execution, and reconciliation—across different people, you create checks and balances. No one person can complete a whole critical task on their own, which helps prevent fraud and reduces the chance of undiscovered errors. Rotating duties periodically also helps surface issues, deter long-term abuse, and spread knowledge so no single person becomes indispensable. For example, in a purchasing workflow, one person might request the purchase, another approves it, a third issues the payment, and a fourth reconciles the bank statement. This separation means a single individual cannot easily misappropriate funds without detection through the other steps. If you think about the other options, they don’t embody this cross-checking approach. Limiting privileges controls what someone can do, but it doesn’t ensure multiple people participate in a process. Detection controls look for problems after the fact, rather than preventing them through divided responsibility. Controlled access focuses on who can reach resources, not on distributing ownership of a process across several individuals.

Dividing responsibilities among multiple people to limit any single individual's power is separation of duties, often paired with job rotation. By splitting the key steps of a process—such as initiation, approval, execution, and reconciliation—across different people, you create checks and balances. No one person can complete a whole critical task on their own, which helps prevent fraud and reduces the chance of undiscovered errors. Rotating duties periodically also helps surface issues, deter long-term abuse, and spread knowledge so no single person becomes indispensable.

For example, in a purchasing workflow, one person might request the purchase, another approves it, a third issues the payment, and a fourth reconciles the bank statement. This separation means a single individual cannot easily misappropriate funds without detection through the other steps.

If you think about the other options, they don’t embody this cross-checking approach. Limiting privileges controls what someone can do, but it doesn’t ensure multiple people participate in a process. Detection controls look for problems after the fact, rather than preventing them through divided responsibility. Controlled access focuses on who can reach resources, not on distributing ownership of a process across several individuals.