A payroll clerk who can edit master file pay rates, run the payroll, and reconcile the bank account is one resignation letter away from owning the company's cash. Strong system controls remove that single point of failure. The exam tests whether you can name the control, classify it, and predict which threat it neutralizes.
Traditional SoD splits authorization, custody, recording, and reconciliation. In an IT environment the categories expand. The systems analyst designs applications. The programmer writes code. The computer operator runs production jobs. The librarian controls program and data file media. The database administrator controls schemas. The security administrator controls access rights. End users initiate transactions. No single person should hold more than one of these roles for the same system.
KEY: A programmer who can also run production jobs can move tested code into live execution with no second pair of eyes, planting fraud or sabotage that bypasses change control.
The exam expects you to name the threat from the fact pattern. Memorize the catalog:
Common mistakes
- Calling antivirus software a firewall. Antivirus scans files and processes for malware signatures. A firewall filters network traffic at the perimeter. The exam will describe a perimeter device that blocks port 23 traffic and offer antivirus as the trap answer.
- Treating hot, warm, and cold as data freshness instead of facility readiness. All three are facility states. Data freshness follows from how often you replicate to that facility. A hot site has hardware ready and data current; a cold site is an empty room with power.
- Confusing a virus with a Trojan horse. A virus self-replicates and needs a host file. A Trojan horse does not self-replicate and hides malicious code inside an apparently legitimate program.
Bottom line
- Segregate authorization, custody, recording, and reconciliation; in IT split analyst, programmer, operator, librarian, DBA, security administrator, and end user, with no person holding two roles for one system
- Three control points: input controls validate data entering, processing controls protect data being transformed, output controls verify results before distribution
- System development controls protect five attributes: accuracy, validity, safety, security, and adaptability across input, processing, output, and storage
- Physical controls limit hardware access; logical controls (IDs, passwords, MFA, least privilege, audit logs) protect programs and databases
Exam shortcut
When a question lists a threat and asks for the matching control, map threat to control category first. Input manipulation maps to input controls (edit checks, check digits). Program alteration maps to change-control and segregated environments. Data theft maps to encryption plus access controls. The mapping is the answer most of the time.
The full lesson (about 2,785 words, 19 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 1E2
Browse all free CMA Part 1 lessons or jump into free CMA Part 1 practice questions.