What should smaller organisations do when they cannot fully separate duties?

Use documented compensating controls such as independent review, supervisor sign-off, and rotating responsibilities, but treat them as temporary exceptions with clear ownership. The goal is to preserve independent oversight, even if the team is too small for perfect role separation in every process.

Why smaller teams need temporary compensating controls, not informal exceptions

When duties cannot be fully separated, the real control objective is not perfection, it is independent oversight. Smaller organisations should use compensating controls that reduce the chance of unilateral error or abuse, then treat the gap as a temporary exception with explicit ownership, review cadence, and a path to remove the exception as the team scales.

That means the substitute control has to preserve an independent check somewhere in the process. Independent review, supervisor approval, and rotation of responsibilities are useful only if they actually break the single-person control loop and are documented well enough that someone else can verify what happened later.

What makes a compensating control credible

A compensating control is credible when it changes the decision path, not just the paperwork. If the same person still initiates, approves, and completes the action, the organisation has not really reduced the risk, it has just renamed it.

Good compensating controls are narrow, explicit, and observable. For example, a supervisor sign-off should apply to a clearly defined set of higher-risk actions, while routine low-risk tasks can remain operationally efficient. Rotation of responsibilities works best when it is structured around the riskiest activities, so no one person becomes the permanent exception-holder.

Documentation matters because temporary exceptions tend to become permanent by habit. Recording the rationale, the control owner, the reviewer, and the expiry date makes the exception auditable and prevents the organisation from confusing a staffing constraint with an acceptable control design.

How small organisations should design for review, rotation, and exception expiry

The practical aim is to distribute trust, even when headcount is tight. The most useful pattern is to separate initiation from verification, then rotate the verification role so that oversight does not collapse into familiarity or convenience.

Assign one named owner for the exception and one independent reviewer for the highest-risk action.
Limit the exception to the exact process step that cannot be separated, not the whole workflow.
Set an expiry date and require a renewal decision instead of leaving the exception open-ended.
Rotate who reviews the activity where a second person is not always available.
Retain evidence of approval, review, and completion so the control can be checked later.

Where possible, use process design to reduce the number of cases needing an exception in the first place. Standardising low-risk approvals, constraining who can make changes, and making review evidence easy to capture all lower the pressure on small teams without pretending that segregation has been fully achieved.

Risk and Threat Considerations

Small teams face a real control-concentration problem: when one person can both execute and validate an action, mistakes are harder to catch and abuse is easier to hide. The risk is not only malicious behaviour, but also simple operational drift, where temporary workarounds silently become the normal way critical tasks are handled.

Failure mechanism: The same individual retains enough authority across the workflow to bypass independent challenge, or the exception remains active long after the staffing issue that justified it has changed.

Impact: Errors, fraud, privilege misuse, and unauthorised changes become harder to detect and investigate, and the organisation loses confidence that approval really means independent oversight.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-5 — Separation of Duties	Directly addresses divided duties and compensating oversight when full separation is impossible.
	AC-6 — Least Privilege	Limits the scope of authority when one person must cover multiple tasks.
	AU-6 — Audit Review, Analysis, and Reporting	Independent review is the core compensating control for small-team duty overlap.
Recommendation — Define compensating approvals and independent review for any duty overlap. Restrict each role to the minimum access needed for the temporary exception. Review audit evidence regularly to verify the second check is actually operating.
ISO/IEC 27001:2022	A.5.3 — Segregation of duties	Explicitly governs duty separation and documented exceptions in an ISMS.
	A.5.15 — Access control	Supports constrained access when role overlap cannot be fully avoided.
Recommendation — Document any segregation exception and require periodic management review. Restrict authority so one person cannot complete every step unchallenged.

Practitioner Guidance

What to prioritise: Protect the highest-risk actions first. If a process can affect money, production systems, access rights, or records integrity, insist on a separate reviewer even if lower-risk tasks stay combined for now.

What to verify: Check that the compensating control actually adds an independent decision point. A second signature only helps if the reviewer has enough context, authority, and willingness to refuse the action when needed.

Decision rule: If the exception is open-ended, not owned, or not reviewed on a schedule, treat it as a control weakness rather than an accepted staffing accommodation.

Practitioner takeaway: In a small organisation, the goal is not to eliminate every overlap immediately, but to make every unavoidable overlap visible, bounded, reviewable, and temporary.