Controls in IRM

[NikkyN943303451]

Does Control Owners and testers need to have different roles?

My understanding is that below are the responsibilities of each. What roles needs to be assigned to control owner and control tester and will they differ?

Control Owner

• Responsible for ensuring controls are implemented and maintained for compliance.
• Manages controls generated from control objectives scoped to entities.
• Oversees the effectiveness of controls through attestations and indicators.
• Participates in the five-step control process, which includes creation, validation, and continuous monitoring of controls.

Control Tester

• Assesses the design and operational effectiveness of controls.
• Executes control tests as part of the control validation process.
• Uses control attestations and indicators to validate policy implementation and effectiveness.
• Documents test results and support remediation if controls are found ineffective.

[svirkar420]

Hi @NikkyN943303451 , 

Yes, control owners and control testers should have different roles assigned to them to enforce the principle of Segregation of Duties (SoD). Allowing the same person to perform both roles creates a major conflict of interest, as a control owner should never "self-test" or audit their own compliance work.

Here is a breakdown of how these distinct responsibilities map to standard system roles (such as in ServiceNow IRM/GRC, SAP GRC, or RSA Archer) and how they differ.

---

Core Role Assignment & System Differences

In most Governance, Risk, and Compliance (GRC) and Integrated Risk Management (IRM) platforms, user permissions are split into distinct tiers to protect audit integrity:

Metric / Dimension Control Owner Role Control Tester Role

Typical System Role	sn_compliance.owner / Business User	sn_compliance.tester / sn_audit.user
Primary System Action	Manages and Attests: Can edit control details, respond to attestations, and log issues.	Evaluates and Validates: Can create test plans, execute test steps, and issue pass/fail verdicts.
Read/Write Scoping	Write access to assigned Controls and Remediation Tasks.	Write access to Control Test Records and Evidence Attachments.
Audit Status	Evaluated party (First Line of Defence).	Independent evaluator (Second or Third Line of Defence).

---

✅ Detailed Responsibility & Mapping Breakdown

1. Control Owner (First Line of Defence)

• System Permissions: Assigned to the specific business line manager or system administrator running the process. They require write access to the control record to update documentation, respond to attestations, and execute remediation plans.
• Why the role differs: They are focused on operational execution. They ensure the control runs daily/weekly and provide the "proof" when requested. They do not have access to alter test criteria or pass/fail their own evaluations.

2. Control Tester (Second or Third Line of Defence)

• System Permissions: Assigned to Risk/Compliance Analysts (2nd Line) or Internal Auditors (3rd Line). They require permissions to create test plans, document sample selections, and record test results.
• Why the role differs: They are focused on independent validation. A tester must have read-only access to the control itself (so they cannot secretly modify the control to make it pass) but full write access to the test worksheet to record structural or operational failures.

---

 Critical Failure Points & Technical Risks

When designing these roles in your system, watch out for these common access control failures:

• The "Inheritance" Loophole: Ensure your organization's IT roles do not inadvertently grant Control Owners "Compliance Manager" or "Admin" overrides, which would allow them to bypass SoD rules and modify or approve their own test results.
• Evidence Tampering: Control Testers should have a system role that locks down test evidence once submitted. Control Owners should only have "Upload" rights during the evidence collection phase and no delete rights once a test begins.
• Small Team Constraints: If your organization is too small to have separate departments, you must still maintain separate system roles. A peer from a different department should be assigned the Tester role for your controls, and vice versa.

If this response helps you mark it as accepted solution and give it a thumbs up 👍. This help me and community to find answers quickly.

Best Regards,

Saurabh V.