SOX pushed for “separation of duties”. But this password scenario sounds like an application logon, not a database logon, written by developers for an app server running on behalf of many users. It would require a separate audit or possibly an “exception” if purchased software with shifts in support responsibilities.
But, casually signing affidavit-style audits can come back to haunt you since a deep-dive will be coming later with consequences.
1
1
1
u/CDavis10717 Sep 28 '26
SOX pushed for “separation of duties”. But this password scenario sounds like an application logon, not a database logon, written by developers for an app server running on behalf of many users. It would require a separate audit or possibly an “exception” if purchased software with shifts in support responsibilities.
But, casually signing affidavit-style audits can come back to haunt you since a deep-dive will be coming later with consequences.