NAZZTEC AI Suite
Why GRC, Third-Party Risk and IT Asset Management Belong on One Platform
Compliance, vendor risk and asset inventory are usually run by different teams in different tools. Regulators and attackers do not respect those boundaries.
Key takeaways
- The requester never approves their own request.
- Enforce it in the system, not only in policy.
- Log requester, approver and executor separately.
- Review exceptions and emergency access regularly.
Where it matters
| Workflow | Risk without it |
|---|---|
| Asset disposal | Devices “disposed” without sanitization or with data |
| Asset allocation | Assets issued without authorization |
| Vendor risk decision | High-risk vendor approved by its sponsor |
| Risk acceptance | Owner accepts their own risk indefinitely |
| Control approval | Control owner marks own control effective |
| User access | Administrator grants themselves rights |
Designing it
- Separate roles for request, approval and execution.
- Block self-approval in the application.
- Require reasons for rejections.
- Time-limit approvals and risk acceptances.
- Notify approvers and escalate delays.
Evidence
Auditors test segregation of duties by sampling requests and checking that the requester and approver differ. A platform that records each separately — in a tamper-evident trail — turns that test into a report.
Testing segregation of duties
- Export requests with requester and approver for the period.
- Filter for any where they match.
- Review emergency and administrator approvals.
- Sample approvals for appropriate seniority.
- Report exceptions and remediation.
Beyond approvals
Segregation of duties also covers who can create users, change roles, edit the audit configuration and export data. Review these permissions at least twice a year and after organizational changes.
Balancing control and speed
Maker–checker should not slow the business down. Route requests to approvers automatically, notify them immediately, escalate after a defined time and let low-risk changes use lighter approval. Measuring approval time keeps the control effective without becoming a bottleneck.
Regulatory expectations
Segregation of duties appears throughout regulation and standards — ISO 27001 control A.5.3, banking supervisors’ expectations for approval of outsourcing and risk acceptance, and internal-control frameworks used by external auditors. Enforcing it inside the system that runs the process is far easier to evidence than relying on policy and manual checks.
How NAZZTEC helps
NAZZTEC AI Suite automates this end to end — with AI assistance, segregation of duties, analytics and signed reports — and is available as SaaS, in your private cloud or on-premises. Our consultants design and run the process alongside it through our Governance, Risk & Compliance services.
Next step: request a demo of NAZZTEC AI Suite or read more on the product page.
Frequently asked questions
What about small teams?
Use a second person from another team or a manager as approver for sensitive actions.
Can administrators bypass it?
Bypass should be exceptional, logged and reviewed.
Is maker–checker the same as four-eyes?
Yes — both mean a second person must verify an action.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.