ISO 27001 Roles & Segregation of Duties (+ Free Template)

ISO 27001:2022 expects an organisation to define who is responsible for what in information security, to separate conflicting duties so no single person can misuse a process undetected, and to communicate those responsibilities to the people who hold them. Three Annex A controls work together here:

A.5.2 — Information security roles and responsibilities: define and allocate them.
A.5.3 — Segregation of duties: separate conflicting duties and areas of responsibility.
A.5.4 — Management responsibilities: require everyone to apply security per policy, and communicate it.

Clear roles stop security from being “everyone’s job and therefore no one’s.” Segregation of duties reduces the risk of fraud and undetected error — the person who requests access shouldn’t approve it; the person who writes code shouldn’t be the only one who ships it to production. Auditors check this early because it is a direct signal of whether accountability is real.

Write down each security role, what it is accountable for, who holds it, and a backup. A simple RACI matrix (Responsible, Accountable, Consulted, Informed) over your key security activities makes gaps obvious. Cover at least:

Access provisioning and approval
Change approval and production deployment
Risk assessment and treatment decisions
Incident response and vulnerability remediation
Vendor/supplier review, backups, and log review

Every activity should have exactly one Accountable owner.

Identify duties that create a conflict of interest when held by one person, and separate them. The classic conflicting pairs:

Duty	Conflicting duty	Why it conflicts
Request access	Approve access	Self-granted privilege
Develop code	Approve & deploy to production	Unreviewed change reaches prod
Create a vendor	Approve the vendor's payment	Fraudulent payee
Administer a system	Review its own audit logs	Hiding one's own actions

Map each conflict, record whether it is currently separated, and — where it isn’t — note the compensating control.

Full segregation isn’t always possible in a small company — and ISO 27001 accepts that, if you compensate. Where one person must hold both sides of a conflict, add a compensating control and document it:

Independent, after-the-fact review of the sensitive action (e.g. a monthly access or deployment review by someone else).
Four-eyes / second approval on the highest-risk actions.
Tamper-evident logging plus alerting on privileged actions.
Management oversight of the residual risk.

Defining roles isn’t enough — people must know and accept them. Communicate responsibilities at onboarding and via the policy portal, and capture acknowledgement (who, what, when). Keep that communication record: it’s the second piece of evidence an auditor asks for on this control, alongside the roles/SoD matrix itself.

A matrix with no owner. Every activity needs one Accountable person.
Unaddressed conflicts. A known conflict with no separation and no compensating control is a finding.
Defined but not communicated. No acknowledgement record = A.5.4 gap.
Set once, never reviewed. Revisit the matrix when the team or org structure changes.

Use our free, editable Roles, Responsibilities & Segregation-of-Duties matrix (Word) to satisfy A.5.2–A.5.4 in one document: a roles table, a RACI matrix, a segregation-of-duties conflict matrix, a compensating-controls table for small teams, and a communication/acknowledgement record. Enter your details below and we’ll reveal the download and email you a copy.

ISO 27001 Roles, Responsibilities & Segregation of Duties

What this control asks for

Why it matters

Defining roles & responsibilities (A.5.2)

Separating conflicting duties (A.5.3)

When the team is too small

Communicating & acknowledging (A.5.4)

Common audit pitfalls

Download the free template

Roles, Responsibilities & Segregation-of-Duties Matrix (A.5.2–A.5.4)