Security & GRCadvanced

SoD Remediation vs Mitigation Controls: Choosing the Right Response (Part 4)

Key takeaway

Prefer remediation when access can be redesigned or removed; use mitigation only when the conflicting access is genuinely required and an independent, effective, owned and evidenced control reduces the risk.

Explanation

📌 KEY POINTS
✅ Two responses to a conflict: remediate (change the access) or mitigate (accept it with a real control).
⚠️ "Manager knows the user" is not a control — a real mitigating control needs an owner, frequency, evidence, and validity period.
💡 GRC can record a mitigating control — it cannot prove the control is actually operating. That needs evidence from the control process.

━━━━━━━━━━━━━━━━━━━━
▶ 1. REMEDIATION (PREFERRED)

Removes/redesigns access so the user no longer holds both conflicting capabilities
Removing a role, splitting a role, restricting values, redesigning responsibility, or replacing direct access with a controlled workflow

━━━━━━━━━━━━━━━━━━━━
▶ 2. MITIGATION (WHEN GENUINELY NEEDED)

Must be specific to the risk, owned by an independent control owner, executed at a defined frequency, produce review evidence, and have a validity period
"Manager knows the user" is not a control

━━━━━━━━━━━━━━━━━━━━
⚠️ 3. DON'T LET IT BECOME PERMANENT DEBT

Periodically re-evaluate whether process redesign now makes remediation possible
GRC can record the mitigating control; it cannot prove the control operates — that evidence comes from the control process itself

━━━━━━━━━━━━━━━━━━━━
▶ 4. RISK ACCEPTANCE

Distinguish residual risk from original risk, approved at the correct authority level

✅ CHECKPOINT: explain why "manager knows the user" fails as a mitigating control.

Real project scenario

A small country office required one employee to create suppliers and enter invoices because staffing was limited. Access could not be fully segregated. The company implemented independent weekly review of supplier changes and payments by regional finance, with documented evidence and expiry. When headcount increased, the conflict was remediated and the mitigation retired.

Common mistakes

Applying mitigation just to remove red results.
Using a generic control for unrelated risks.
Having the conflicted user perform their own mitigating review.
Leaving mitigation with no expiry.
Never revisiting whether remediation became possible.

Best practices

Remediate first where practical.
Make mitigation risk-specific and independent.
Require operating evidence.
Set validity/expiry.
Periodically reassess residual risk.

Interview angle

Explain remediation as removal/redesign of conflict and mitigation as an independent compensating control for necessary access. Strong answers list owner, frequency, evidence and validity.

Practice this lesson

Quick check

1. A review of SoD Remediation vs Mitigation Controls: Choosing the Right Response finds this risky pattern: "Approving access before simulation.". Which corrective action is strongest?

2. Scenario — A small country office required one employee to create suppliers and enter invoices because staffing was limited. Which response best addresses the design or operating risk in SoD Remediation vs Mitigation Controls: Choosing the Right Response?

3. Scenario — A user had access to maintain supplier bank details and process payments. Which response best addresses the design or operating risk in Segregation of Duties Fundamentals: Risks, Functions and Conflicting Access?

Interview questions

1. You are the senior consultant/architect responsible for SoD Remediation vs Mitigation Controls: Choosing the Right Response. The project situation is: A small country office required one employee to create suppliers and enter invoices because staffing was limited. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?

Answer it in your own words first, then compare.

2. Using this SAP project situation — Analyze a user with vendor-maintenance and payment-processing access — explain Segregation of Duties Fundamentals for SAP. What should happen, which concepts or process steps matter, and what common mistake would you avoid?

Answer it in your own words first, then compare.

Practice more with Interview AI →

Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.