Which of the following is NOT a best practice for separation of duties within the information systems department and between IT and business unit personnel?

• A. End users should not have access to production data outside the scope of their normal job duties.
• B. Programmers should not be responsible for testing programs.
• C. Only programmers should be server administrators.
• D. IT departments should not overlap with information user departments.

Answer: (C)

Separation of duties means spreading key responsibilities across different people or groups so no single person can both cause and approve a potentially harmful action. In the context of server administration, giving the sole responsibility to programmers concentrates highly privileged access in one role, which undermines governance and the ability to detect and prevent improper changes. When admins are separated from development, there are checks and balances: changes to production go through proper change-management processes, and operations teams can monitor and audit activity independently of who wrote the code. This reduces the risk of undetected tampering, accidental misconfiguration, or rushed deployments.

End-user access to production data should be restricted to what their role requires, supporting least privilege. Programmers should not also be the ones testing their own code, creating a separation between development and verification to catch issues a developer might overlook. IT departments should maintain clear boundaries from business units to avoid conflicts of interest and ensure proper governance and oversight.

So the statement that only programmers should be server administrators breaks the separation of duties and is not a best practice.