How do SoD policies differ from general policies?

• A. SoDs require user training
• B. SoDs enforce exclusive access item lists
• C. General policies are time-based
• D. SoDs are only for external users

Answer: (B)

SoD, or Segregation of Duties, policies are specifically designed to prevent conflicts of interest by ensuring that no single individual has control over multiple steps in a critical process. This approach enforces exclusive access item lists, which means that certain roles or functions cannot be assigned to the same user to mitigate risks such as fraud or errors. By maintaining exclusive access to specific tasks or resources, organizations can ensure that there is a checks-and-balances system in place.

This contrasts with general policies, which may cover a broad range of governance, risk, and compliance requirements but do not specifically focus on separating duties to prevent conflicts. SoD policies are fundamentally about structuring roles and responsibilities in a way that promotes accountability and security, rather than simply providing broad guidelines for user behavior or compliance.