Segregation of duties
The seat that creates a payee or a Bill never approves its payment, counted by seat, not by agent identity.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC5.1 | The entity selects and develops control activities that mitigate risks to its objectives to acceptable levels. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Preventive: it stops the failure before it happens. |
| Select | Every Bill paid in the report period. |
| Assert | The seat that approved each Bill differs from the seats that created its payee and the Bill. |
Owner
Example
The Finance Lead seat adds a new contractor as a payee and enters her first $3,000 Bill. Payment waits for the Treasurer seat to approve it, even though one Agent fills both seats.