foxhunt/docs/sox/SEPARATION_OF_DUTIES.md

# Separation of Duties Matrix - Foxhunt HFT Trading System

**Version**: 1.0
**Last Updated**: 2025-10-07
**Status**: Production Ready

---

## Table of Contents

1. [Overview](#overview)
2. [Role Definitions](#role-definitions)
3. [Permission Matrix](#permission-matrix)
4. [Incompatible Role Combinations](#incompatible-role-combinations)
5. [Required Separations](#required-separations)
6. [Exception Process](#exception-process)
7. [Quarterly Review Process](#quarterly-review-process)

---

## Overview

### Purpose

**Separation of Duties (SOD)** is a fundamental internal control that prevents any single person from controlling all aspects of a critical transaction or process. This reduces the risk of:
- **Fraud**: One person cannot initiate, approve, and conceal a fraudulent transaction
- **Error**: Multiple people reviewing increases error detection
- **Conflicts of Interest**: Traders cannot approve their own trades

### SOX Requirements

- **Section 302**: Management must establish and maintain SOD as part of internal controls
- **Section 404**: External auditors must test SOD effectiveness
- **Section 802**: Criminal penalties for violating SOD controls (up to 20 years)

### Key Principles

1. **No Single Point of Control**: Critical processes require multiple people
2. **Independent Review**: Reviewers must be independent of process initiators
3. **Audit Trail**: All actions logged with WHO, WHAT, WHEN, WHERE, WHY
4. **Exception Management**: SOD violations require executive approval with compensating controls
5. **Regular Review**: Quarterly access reviews to detect SOD violations

---

## Role Definitions

### Trading Roles

#### ROLE-TRADER (Junior Trader)
**Description**: Entry-level trader with limited trading authority

**Permissions**:
- Create orders (limited to $100K per order, $1M daily limit)
- View own positions
- View market data (real-time)
- Cancel own orders (before execution)
- View own P&L

**Restrictions**:
- Cannot approve orders
- Cannot modify other traders' orders
- Cannot override risk limits
- Cannot access production configurations

**Risk Level**: High
**Requires Approval**: Yes (from Senior Trader or Trading Manager)

---

#### ROLE-SENIOR-TRADER (Senior Trader)
**Description**: Experienced trader with higher trading limits

**Permissions**:
- Create orders (up to $1M per order, $10M daily limit)
- View own positions and team positions
- Approve Junior Trader orders (up to $500K)
- Modify own orders (before execution)
- View real-time risk metrics (VaR, exposure)

**Restrictions**:
- Cannot approve own orders > $500K
- Cannot approve orders for accounts they trade
- Cannot override risk limits
- Cannot access audit trails

**Risk Level**: High
**Requires Approval**: Yes (from Trading Manager or CRO)

---

#### ROLE-TRADING-MANAGER (Trading Manager)
**Description**: Manager overseeing trading desk

**Permissions**:
- Create orders (up to $5M per order, $50M daily limit)
- View all trading desk positions
- Approve orders up to $5M
- Manage trader permissions (assign ROLE-TRADER, ROLE-SENIOR-TRADER)
- View trading desk P&L
- Approve emergency overrides (with CRO approval)

**Restrictions**:
- Cannot approve own orders > $1M
- Cannot modify audit trails
- Cannot access production databases directly
- Cannot deploy code

**Risk Level**: Critical
**Requires Approval**: Yes (from CRO or CFO)

---

### Risk Management Roles

#### ROLE-RISK-ANALYST (Risk Analyst)
**Description**: Monitors risk metrics and generates risk reports

**Permissions**:
- View all positions (read-only)
- View risk metrics (VaR, Greeks, exposure)
- Generate risk reports
- View audit trails (read-only)
- Configure risk alerts (thresholds)

**Restrictions**:
- Cannot create or modify orders
- Cannot approve trades
- Cannot override risk limits
- Cannot modify risk configurations

**Risk Level**: Medium
**Requires Approval**: No

---

#### ROLE-RISK-MANAGER (Risk Manager)
**Description**: Sets risk limits and approves limit breaches

**Permissions**:
- View all positions (read-only)
- Configure risk limits (VaR, position size, concentration)
- Approve risk limit breaches (temporary)
- Approve emergency overrides
- Generate risk reports
- View audit trails (read-only)

**Restrictions**:
- Cannot create or modify orders
- Cannot approve trades
- Cannot trade on own account
- Cannot modify audit trails

**Risk Level**: Critical
**Requires Approval**: Yes (from CRO or CFO)

---

#### ROLE-CRO (Chief Risk Officer)
**Description**: Ultimate authority on risk matters

**Permissions**:
- Full read access to all positions, trades, risk metrics
- Configure all risk limits
- Approve all risk limit breaches
- Approve emergency overrides
- Review all audit trails
- Terminate trading activities (emergency stop)

**Restrictions**:
- Cannot create or execute trades
- Cannot approve trades
- Cannot modify audit trails (read-only)
- Cannot deploy code

**Risk Level**: Critical
**Requires Approval**: Yes (from CEO or Board)

---

### Operations Roles

#### ROLE-OPERATIONS (Operations Analyst)
**Description**: Handles post-trade operations (settlement, reconciliation)

**Permissions**:
- View executed trades (read-only)
- View positions (read-only)
- Reconcile positions with broker statements
- Generate operational reports
- Create settlement instructions

**Restrictions**:
- Cannot create or modify orders
- Cannot approve trades
- Cannot modify trade details
- Cannot access pre-trade systems

**Risk Level**: Low
**Requires Approval**: No

---

#### ROLE-OPERATIONS-MANAGER (Operations Manager)
**Description**: Manages post-trade operations

**Permissions**:
- View all executed trades (read-only)
- View all positions (read-only)
- Approve settlement exceptions
- Approve reconciliation breaks
- Manage operations team permissions
- Generate operational reports

**Restrictions**:
- Cannot create or modify orders
- Cannot approve trades
- Cannot modify audit trails
- Cannot access pre-trade systems

**Risk Level**: Medium
**Requires Approval**: Yes (from CFO)

---

### Technology Roles

#### ROLE-DEVELOPER (Software Developer)
**Description**: Develops and maintains trading system

**Permissions**:
- Access development environment
- Deploy to staging environment
- View application logs (non-production)
- Create and review code changes
- Run tests

**Restrictions**:
- Cannot deploy to production
- Cannot access production database
- Cannot view production audit trails
- Cannot modify production configurations

**Risk Level**: Medium
**Requires Approval**: No

---

#### ROLE-DEVOPS (DevOps Engineer)
**Description**: Manages production infrastructure

**Permissions**:
- Deploy code to production (with approval)
- Access production logs (read-only)
- Monitor system health
- Manage infrastructure (servers, networks)
- Configure monitoring and alerting

**Restrictions**:
- Cannot modify production code without approval
- Cannot access production database (except for backups)
- Cannot view sensitive business data
- Cannot modify audit trail configurations

**Risk Level**: Critical
**Requires Approval**: Yes (from CTO)

---

#### ROLE-CTO (Chief Technology Officer)
**Description**: Ultimate authority on technology matters

**Permissions**:
- Approve production deployments
- Access all system components
- Configure system settings
- Review audit trails (technology events)
- Emergency system shutdown

**Restrictions**:
- Cannot create or execute trades
- Cannot approve trades
- Cannot modify audit trails (read-only)
- Cannot override financial controls without CFO approval

**Risk Level**: Critical
**Requires Approval**: Yes (from CEO or Board)

---

### Compliance & Audit Roles

#### ROLE-COMPLIANCE-OFFICER (Compliance Officer)
**Description**: Ensures regulatory compliance

**Permissions**:
- View all audit trails (read-only)
- View all trades and positions (read-only)
- Generate compliance reports
- Configure compliance rules
- Approve compliance exceptions

**Restrictions**:
- Cannot create or execute trades
- Cannot approve trades
- Cannot modify audit trails (read-only)
- Cannot modify risk limits

**Risk Level**: Medium
**Requires Approval**: Yes (from CEO or General Counsel)

---

#### ROLE-AUDITOR (Internal/External Auditor)
**Description**: Performs audits of trading operations

**Permissions**:
- View all audit trails (read-only)
- View all trades, positions, and reports (read-only)
- View system configurations (read-only)
- View access control matrix (read-only)

**Restrictions**:
- Cannot modify any data
- Cannot create or execute trades
- Cannot approve trades
- Time-limited access (30-90 days per audit)

**Risk Level**: Low
**Requires Approval**: Yes (from CFO or Audit Committee)

---

### Administrative Roles

#### ROLE-ADMIN (System Administrator)
**Description**: Manages user accounts and permissions

**Permissions**:
- Create and manage user accounts
- Assign roles to users (up to Senior Trader level)
- Reset passwords
- Configure MFA
- View access logs (read-only)

**Restrictions**:
- Cannot assign ROLE-ADMIN to others (requires CTO)
- Cannot create or execute trades
- Cannot approve trades
- Cannot modify audit trails

**Risk Level**: Critical
**Requires Approval**: Yes (from CTO)

---

#### ROLE-CFO (Chief Financial Officer)
**Description**: Ultimate authority on financial matters

**Permissions**:
- View all financial data (trades, positions, P&L, reports)
- Approve financial controls
- Approve risk limits
- Review audit trails (financial events)
- Certify financial statements (SOX 302)

**Restrictions**:
- Cannot create or execute trades
- Cannot approve individual trades
- Cannot modify audit trails (read-only)
- Cannot deploy code

**Risk Level**: Critical
**Requires Approval**: Yes (from CEO or Board)

---

#### ROLE-CEO (Chief Executive Officer)
**Description**: Ultimate authority on company operations

**Permissions**:
- View all company data
- Approve all critical controls
- Approve exceptions to SOD policies
- Certify financial statements (SOX 302)
- Authorize emergency overrides

**Restrictions**:
- Cannot create or execute trades (in person)
- Cannot modify audit trails (read-only)
- Cannot directly modify code or configurations

**Risk Level**: Critical
**Requires Approval**: Yes (from Board of Directors)

---

## Permission Matrix

| Resource | Trader | Sr Trader | Trading Mgr | Risk Mgr | CRO | Operations | Developer | DevOps | CTO | Compliance | CFO | CEO |
|----------|--------|-----------|-------------|----------|-----|------------|-----------|--------|-----|------------|-----|-----|
| **Create Order** | ✓ (limit) | ✓ (limit) | ✓ (limit) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| **Approve Order** | ✗ | ✓ (limit) | ✓ (limit) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| **Cancel Order** | ✓ (own) | ✓ (own+team) | ✓ (all) | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| **View Positions** | ✓ (own) | ✓ (team) | ✓ (desk) | ✓ (all) | ✓ (all) | ✓ (all) | ✗ | ✗ | ✓ (all) | ✓ (all) | ✓ (all) | ✓ (all) |
| **Modify Position** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| **Set Risk Limits** | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ |
| **Override Risk Limits** | ✗ | ✗ | ✓ (temp) | ✓ (temp) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ |
| **View Audit Trails** | ✗ | ✗ | ✗ | ✓ (RO) | ✓ (RO) | ✗ | ✗ | ✗ | ✓ (RO) | ✓ (RO) | ✓ (RO) | ✓ (RO) |
| **Modify Audit Trails** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| **Deploy Code** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ (staging) | ✓ (prod) | ✓ (all) | ✗ | ✗ | ✗ |
| **Modify Config** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ (approval) | ✓ | ✗ | ✗ | ✓ |
| **Access Prod DB** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ (RO) | ✗ | ✗ | ✗ |
| **Manage Users** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ |
| **Financial Reports** | ✗ | ✗ | ✓ (desk) | ✓ (all) | ✓ (all) | ✓ (all) | ✗ | ✗ | ✗ | ✓ (all) | ✓ (all) | ✓ (all) |
| **Compliance Reports** | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✓ |

**Legend**:
- ✓ = Allowed
- ✓ (limit) = Allowed with limits/constraints
- ✓ (RO) = Read-only access
- ✗ = Not allowed

---

## Incompatible Role Combinations

These role combinations create conflicts of interest and MUST be prevented:

### SOD-001: Trader + Risk Approver
- **Role A**: ROLE-TRADER, ROLE-SENIOR-TRADER, ROLE-TRADING-MANAGER
- **Role B**: ROLE-RISK-MANAGER, ROLE-CRO
- **Reason**: Trader cannot approve own risk limits or overrides
- **Control**: System enforces - trader's risk approvals require independent risk manager
- **Exception Process**: CFO approval required + compensating controls (dual approval, enhanced monitoring)

### SOD-002: Order Creator + Order Approver (Same Account)
- **Role A**: ROLE-TRADER
- **Role B**: ROLE-SENIOR-TRADER (when approving for same account)
- **Reason**: Cannot create and approve same order
- **Control**: System checks - order creator ≠ order approver for same order_id
- **Exception Process**: NONE - No exceptions allowed (SOX Section 302)

### SOD-003: Payment Initiator + Payment Approver
- **Role A**: ROLE-OPERATIONS
- **Role B**: ROLE-OPERATIONS-MANAGER
- **Reason**: Financial control separation (4-eyes principle)
- **Control**: Settlements > $100K require dual approval from Operations + CFO
- **Exception Process**: Dual approval from CFO + CEO required

### SOD-004: Developer + Production Deployer
- **Role A**: ROLE-DEVELOPER
- **Role B**: ROLE-DEVOPS
- **Reason**: Developer cannot deploy own code
- **Control**: Code review + independent deployment (DevOps)
- **Exception Process**: CTO approval + independent code review required

### SOD-005: Trader + P&L Calculator
- **Role A**: ROLE-TRADER, ROLE-SENIOR-TRADER, ROLE-TRADING-MANAGER
- **Role B**: ROLE-OPERATIONS (for P&L reconciliation)
- **Reason**: Trader cannot calculate own P&L
- **Control**: Independent P&L calculation by Operations
- **Exception Process**: CFO approval + dual calculation (Operations + Risk)

### SOD-006: Config Modifier + Auditor
- **Role A**: ROLE-ADMIN, ROLE-DEVOPS, ROLE-CTO
- **Role B**: ROLE-AUDITOR
- **Reason**: Cannot audit own changes
- **Control**: External auditors are independent (not employees)
- **Exception Process**: NONE - Use external auditor

### SOD-007: Audit Trail Owner + System User
- **Role A**: ROLE-DEVOPS (manages audit trail infrastructure)
- **Role B**: Any trading or operational role
- **Reason**: Audit trail admin cannot modify own audit entries
- **Control**: Audit trail is immutable (write-once), checksums prevent tampering
- **Exception Process**: NONE - Technical control enforces immutability

### SOD-008: Financial Reporting + Trading
- **Role A**: ROLE-CFO, ROLE-OPERATIONS (for financial reporting)
- **Role B**: ROLE-TRADER, ROLE-SENIOR-TRADER, ROLE-TRADING-MANAGER
- **Reason**: Financial reporter cannot influence reported results
- **Control**: CFO and Operations cannot execute trades
- **Exception Process**: NONE - No exceptions allowed

---

## Required Separations

### SEP-001: Trade Execution Process
**Process**: Trade Lifecycle (Entry → Approval → Execution → Settlement)

**Separated Functions**:
1. **Trade Entry**: ROLE-TRADER (creates order)
2. **Trade Approval**: ROLE-SENIOR-TRADER or ROLE-TRADING-MANAGER (approves order)
3. **Risk Check**: ROLE-RISK-MANAGER (validates risk limits)
4. **Execution**: System (automated) or External Broker
5. **Settlement**: ROLE-OPERATIONS (reconciles and settles)

**Justification**: SOX 404 control requirement - no single person controls entire trade lifecycle

**Testing**: Quarterly - sample 25 trades, verify different actors for each step

---

### SEP-002: Financial Reporting Process
**Process**: P&L Calculation and Reporting

**Separated Functions**:
1. **Trade Data**: ROLE-TRADER (generates trade data)
2. **P&L Calculation**: ROLE-OPERATIONS (calculates P&L)
3. **Risk Calculation**: ROLE-RISK-MANAGER (calculates VaR, Greeks)
4. **Variance Analysis**: ROLE-RISK-ANALYST (analyzes P&L vs. risk)
5. **Report Approval**: ROLE-CFO (certifies financial report)

**Justification**: SOX 302 certification requirement - independent P&L calculation

**Testing**: Monthly - recalculate P&L for sample period, verify variance < 0.1%

---

### SEP-003: System Change Management
**Process**: Code Deployment

**Separated Functions**:
1. **Code Development**: ROLE-DEVELOPER (writes code)
2. **Code Review**: ROLE-SENIOR-DEVELOPER (reviews code, not original author)
3. **Deployment Approval**: ROLE-CTO (approves production deployment)
4. **Deployment Execution**: ROLE-DEVOPS (deploys to production)
5. **Post-Deployment Validation**: ROLE-CTO or ROLE-OPERATIONS (validates)

**Justification**: SOX 404 control requirement - change control

**Testing**: Quarterly - sample 10 deployments, verify separation

---

### SEP-004: Access Management
**Process**: User Provisioning and Access Changes

**Separated Functions**:
1. **Access Request**: Manager (requests access for team member)
2. **Access Approval**: ROLE-CTO or ROLE-CFO (approves based on role)
3. **Access Provisioning**: ROLE-ADMIN (provisions access)
4. **Access Review**: ROLE-COMPLIANCE-OFFICER (quarterly review)

**Justification**: SOX 404 control requirement - access control

**Testing**: Quarterly - review all access changes, verify approvals

---

## Exception Process

### When Exceptions Are Allowed

1. **Small Team Size**: Company has < 10 employees, insufficient staff for full separation
2. **Emergency Situations**: Critical system failure requires immediate fix
3. **Temporary Staffing Gaps**: Key personnel on vacation/leave
4. **Business Necessity**: Legitimate business need with no alternative

### Exception Requirements

**All exceptions require**:
1. **Business Justification**: Detailed explanation of why exception is necessary
2. **Risk Assessment**: Document risks introduced by SOD violation
3. **Executive Approval**: CFO/CEO approval required
4. **Compensating Controls**: Additional controls to mitigate risk
5. **Time Limit**: Exceptions are temporary (max 90 days)
6. **Enhanced Monitoring**: Increased audit logging and review
7. **Documentation**: All exceptions logged in SOX compliance system

### Example Exception Process

**Scenario**: Only one DevOps engineer available, needs to deploy code they helped develop

**Exception Request**:
```
Exception ID: SOD-EXC-2024-001
Date Requested: 2024-12-15
Requested By: John Doe (CTO)

SOD Rule Violated: SOD-004 (Developer + Production Deployer)

Business Justification:
- DevOps engineer (Alice) is sole person with production access
- Critical bug fix needed for trade reconciliation
- Waiting for external help would delay 1 week
- Financial impact: $50K per day in reconciliation costs

Risk Assessment:
- Risk: Alice could deploy malicious or buggy code without review
- Probability: Low (Alice is trusted employee, 5 years tenure)
- Impact: High (production outage, financial loss)

Compensating Controls:
1. Independent code review by external consultant (Bob)
2. CTO (John) to be present during deployment (video call)
3. Enhanced logging of all deployment actions
4. Post-deployment review within 24 hours
5. Emergency rollback plan tested and ready

Time Limit: 7 days (until second DevOps engineer hired)

Approvals Required:
- CTO Approval: [Signature]
- CFO Approval: [Signature]
- CEO Approval: [Signature]

Status: APPROVED
```

**Compensating Controls**:
- Dual approval (CTO + CFO)
- Independent code review
- Real-time monitoring during deployment
- Post-deployment audit
- Enhanced logging (all actions by Alice)

**Monitoring**:
- Daily review of Alice's actions
- CFO notified of all production changes
- External audit of exception after 7 days

**Termination**:
- Exception expires after 7 days
- New DevOps engineer hired and trained
- SOD-004 control reinstated
- Post-exception audit conducted

---

## Quarterly Review Process

### Access Review Schedule

**Q1 Review** (January - March):
- Due Date: April 15
- Scope: All users, all roles
- Reviewer: Compliance Officer + CFO

**Q2 Review** (April - June):
- Due Date: July 15
- Scope: Privileged roles (Admin, DevOps, CTO, CFO, CEO)
- Reviewer: External Auditor

**Q3 Review** (July - September):
- Due Date: October 15
- Scope: All users, all roles
- Reviewer: Compliance Officer + CFO

**Q4 Review** (October - December):
- Due Date: January 15
- Scope: All users, all roles + Annual SOD assessment
- Reviewer: External Auditor + Audit Committee

### Review Procedures

**1. Generate Access Report**
```sql
-- Query current user roles
SELECT
    u.user_id,
    u.username,
    u.email,
    ARRAY_AGG(r.role_name) as roles,
    u.last_login,
    u.status
FROM users u
JOIN user_roles ur ON u.user_id = ur.user_id
JOIN roles r ON ur.role_id = r.role_id
WHERE u.status = 'ACTIVE'
GROUP BY u.user_id, u.username, u.email, u.last_login, u.status
ORDER BY u.username;
```

**2. Review Each User**
- Is user still employed?
- Does user still need this access for their job?
- Are assigned roles appropriate for job function?
- Any SOD violations? (check against incompatible combinations)
- Last activity date (flag inactive users > 90 days)

**3. Document Findings**
```
User: alice@foxhunt.com
Current Roles: ROLE-TRADER, ROLE-RISK-ANALYST
Review Findings:
- ✓ User is active employee (Trader)
- ✓ ROLE-TRADER is appropriate for job function
- ✗ ROLE-RISK-ANALYST is not appropriate (SOD violation - trader cannot be risk analyst)
- Action Required: Remove ROLE-RISK-ANALYST
- Approved By: CFO
- Completed: 2024-04-10
```

**4. Remediation**
- Revoke inappropriate access within 5 business days
- Document rationale for access that is retained
- Flag SOD violations for executive review
- Update access control matrix

**5. Certification**
```
I, [Compliance Officer Name], certify that I have reviewed user access
as of [Quarter End Date] and:

1. All users have been reviewed for appropriate access
2. Inappropriate access has been removed
3. All SOD violations have been documented and addressed
4. No material weaknesses in access controls were identified

Date: [Date]
Signature: _______________________
[Compliance Officer Name]

Approved By:
CFO Signature: _______________________
Date: [Date]
```

---

**Document Owner**: Compliance Officer
**Approval**: CFO, CTO, General Counsel
**Next Review Date**: 2026-01-01