Segregation of Duties Risk Quantification

Inside this paper

1. Why catalogue SoD reports overstate the real risk by an order of magnitude
2. How to score SoD findings by actual transaction execution and risk weight
3. The communication model that translates technical findings for the audit committee
4. The remediation patterns that address conflicts at the role design level
5. How to scope mitigating controls when remediation is not yet feasible
6. The steady state metrics that demonstrate a continuously improving control environment