foxhunt/docs/sox/SEPARATION_OF_DUTIES.md

Separation of Duties Matrix - Foxhunt HFT Trading System

Version: 1.0 Last Updated: 2025-10-07 Status: Production Ready

---

Table of Contents

1. Overview
2. Role Definitions
3. Permission Matrix
4. Incompatible Role Combinations
5. Required Separations
6. Exception Process
7. Quarterly Review Process

---

Overview

Purpose

Separation of Duties (SOD) is a fundamental internal control that prevents any single person from controlling all aspects of a critical transaction or process. This reduces the risk of:

• Fraud: One person cannot initiate, approve, and conceal a fraudulent transaction
• Error: Multiple people reviewing increases error detection
• Conflicts of Interest: Traders cannot approve their own trades

SOX Requirements

• Section 302: Management must establish and maintain SOD as part of internal controls
• Section 404: External auditors must test SOD effectiveness
• Section 802: Criminal penalties for violating SOD controls (up to 20 years)

Key Principles

1. No Single Point of Control: Critical processes require multiple people
2. Independent Review: Reviewers must be independent of process initiators
3. Audit Trail: All actions logged with WHO, WHAT, WHEN, WHERE, WHY
4. Exception Management: SOD violations require executive approval with compensating controls
5. Regular Review: Quarterly access reviews to detect SOD violations

---

Role Definitions

Trading Roles

ROLE-TRADER (Junior Trader)

Description: Entry-level trader with limited trading authority

Permissions:

• Create orders (limited to $100K per order, $1M daily limit)
• View own positions
• View market data (real-time)
• Cancel own orders (before execution)
• View own P&L

Restrictions:

• Cannot approve orders
• Cannot modify other traders' orders
• Cannot override risk limits
• Cannot access production configurations

Risk Level: High Requires Approval: Yes (from Senior Trader or Trading Manager)

---

ROLE-SENIOR-TRADER (Senior Trader)

Description: Experienced trader with higher trading limits

Permissions:

• Create orders (up to $1M per order, $10M daily limit)
• View own positions and team positions
• Approve Junior Trader orders (up to $500K)
• Modify own orders (before execution)
• View real-time risk metrics (VaR, exposure)

Restrictions:

• Cannot approve own orders > $500K
• Cannot approve orders for accounts they trade
• Cannot override risk limits
• Cannot access audit trails

Risk Level: High Requires Approval: Yes (from Trading Manager or CRO)

---

ROLE-TRADING-MANAGER (Trading Manager)

Description: Manager overseeing trading desk

Permissions:

• Create orders (up to $5M per order, $50M daily limit)
• View all trading desk positions
• Approve orders up to $5M
• Manage trader permissions (assign ROLE-TRADER, ROLE-SENIOR-TRADER)
• View trading desk P&L
• Approve emergency overrides (with CRO approval)

Restrictions:

• Cannot approve own orders > $1M
• Cannot modify audit trails
• Cannot access production databases directly
• Cannot deploy code

Risk Level: Critical Requires Approval: Yes (from CRO or CFO)

---

Risk Management Roles

ROLE-RISK-ANALYST (Risk Analyst)

Description: Monitors risk metrics and generates risk reports

Permissions:

• View all positions (read-only)
• View risk metrics (VaR, Greeks, exposure)
• Generate risk reports
• View audit trails (read-only)
• Configure risk alerts (thresholds)

Restrictions:

• Cannot create or modify orders
• Cannot approve trades
• Cannot override risk limits
• Cannot modify risk configurations

Risk Level: Medium Requires Approval: No

---

ROLE-RISK-MANAGER (Risk Manager)

Description: Sets risk limits and approves limit breaches

Permissions:

• View all positions (read-only)
• Configure risk limits (VaR, position size, concentration)
• Approve risk limit breaches (temporary)
• Approve emergency overrides
• Generate risk reports
• View audit trails (read-only)

Restrictions:

• Cannot create or modify orders
• Cannot approve trades
• Cannot trade on own account
• Cannot modify audit trails

Risk Level: Critical Requires Approval: Yes (from CRO or CFO)

---

ROLE-CRO (Chief Risk Officer)

Description: Ultimate authority on risk matters

Permissions:

• Full read access to all positions, trades, risk metrics
• Configure all risk limits
• Approve all risk limit breaches
• Approve emergency overrides
• Review all audit trails
• Terminate trading activities (emergency stop)

Restrictions:

• Cannot create or execute trades
• Cannot approve trades
• Cannot modify audit trails (read-only)
• Cannot deploy code

Risk Level: Critical Requires Approval: Yes (from CEO or Board)

---

Operations Roles

ROLE-OPERATIONS (Operations Analyst)

Description: Handles post-trade operations (settlement, reconciliation)

Permissions:

• View executed trades (read-only)
• View positions (read-only)
• Reconcile positions with broker statements
• Generate operational reports
• Create settlement instructions

Restrictions:

• Cannot create or modify orders
• Cannot approve trades
• Cannot modify trade details
• Cannot access pre-trade systems

Risk Level: Low Requires Approval: No

---

ROLE-OPERATIONS-MANAGER (Operations Manager)

Description: Manages post-trade operations

Permissions:

• View all executed trades (read-only)
• View all positions (read-only)
• Approve settlement exceptions
• Approve reconciliation breaks
• Manage operations team permissions
• Generate operational reports

Restrictions:

• Cannot create or modify orders
• Cannot approve trades
• Cannot modify audit trails
• Cannot access pre-trade systems

Risk Level: Medium Requires Approval: Yes (from CFO)

---

Technology Roles

ROLE-DEVELOPER (Software Developer)

Description: Develops and maintains trading system

Permissions:

• Access development environment
• Deploy to staging environment
• View application logs (non-production)
• Create and review code changes
• Run tests

Restrictions:

• Cannot deploy to production
• Cannot access production database
• Cannot view production audit trails
• Cannot modify production configurations

Risk Level: Medium Requires Approval: No

---

ROLE-DEVOPS (DevOps Engineer)

Description: Manages production infrastructure

Permissions:

• Deploy code to production (with approval)
• Access production logs (read-only)
• Monitor system health
• Manage infrastructure (servers, networks)
• Configure monitoring and alerting

Restrictions:

• Cannot modify production code without approval
• Cannot access production database (except for backups)
• Cannot view sensitive business data
• Cannot modify audit trail configurations

Risk Level: Critical Requires Approval: Yes (from CTO)

---

ROLE-CTO (Chief Technology Officer)

Description: Ultimate authority on technology matters

Permissions:

• Approve production deployments
• Access all system components
• Configure system settings
• Review audit trails (technology events)
• Emergency system shutdown

Restrictions:

• Cannot create or execute trades
• Cannot approve trades
• Cannot modify audit trails (read-only)
• Cannot override financial controls without CFO approval

Risk Level: Critical Requires Approval: Yes (from CEO or Board)

---

Compliance & Audit Roles

ROLE-COMPLIANCE-OFFICER (Compliance Officer)

Description: Ensures regulatory compliance

Permissions:

• View all audit trails (read-only)
• View all trades and positions (read-only)
• Generate compliance reports
• Configure compliance rules
• Approve compliance exceptions

Restrictions:

• Cannot create or execute trades
• Cannot approve trades
• Cannot modify audit trails (read-only)
• Cannot modify risk limits

Risk Level: Medium Requires Approval: Yes (from CEO or General Counsel)

---

ROLE-AUDITOR (Internal/External Auditor)

Description: Performs audits of trading operations

Permissions:

• View all audit trails (read-only)
• View all trades, positions, and reports (read-only)
• View system configurations (read-only)
• View access control matrix (read-only)

Restrictions:

• Cannot modify any data
• Cannot create or execute trades
• Cannot approve trades
• Time-limited access (30-90 days per audit)

Risk Level: Low Requires Approval: Yes (from CFO or Audit Committee)

---

Administrative Roles

ROLE-ADMIN (System Administrator)

Description: Manages user accounts and permissions

Permissions:

• Create and manage user accounts
• Assign roles to users (up to Senior Trader level)
• Reset passwords
• Configure MFA
• View access logs (read-only)

Restrictions:

• Cannot assign ROLE-ADMIN to others (requires CTO)
• Cannot create or execute trades
• Cannot approve trades
• Cannot modify audit trails

Risk Level: Critical Requires Approval: Yes (from CTO)

---

ROLE-CFO (Chief Financial Officer)

Description: Ultimate authority on financial matters

Permissions:

• View all financial data (trades, positions, P&L, reports)
• Approve financial controls
• Approve risk limits
• Review audit trails (financial events)
• Certify financial statements (SOX 302)

Restrictions:

• Cannot create or execute trades
• Cannot approve individual trades
• Cannot modify audit trails (read-only)
• Cannot deploy code

Risk Level: Critical Requires Approval: Yes (from CEO or Board)

---

ROLE-CEO (Chief Executive Officer)

Description: Ultimate authority on company operations

Permissions:

• View all company data
• Approve all critical controls
• Approve exceptions to SOD policies
• Certify financial statements (SOX 302)
• Authorize emergency overrides

Restrictions:

• Cannot create or execute trades (in person)
• Cannot modify audit trails (read-only)
• Cannot directly modify code or configurations

Risk Level: Critical Requires Approval: Yes (from Board of Directors)

---

Permission Matrix

Resource	Trader	Sr Trader	Trading Mgr	Risk Mgr	CRO	Operations	Developer	DevOps	CTO	Compliance	CFO	CEO
Create Order	✓ (limit)	✓ (limit)	✓ (limit)	✗	✗	✗	✗	✗	✗	✗	✗	✗
Approve Order	✗	✓ (limit)	✓ (limit)	✗	✗	✗	✗	✗	✗	✗	✗	✗
Cancel Order	✓ (own)	✓ (own+team)	✓ (all)	✗	✗	✗	✗	✗	✗	✗	✗	✗
View Positions	✓ (own)	✓ (team)	✓ (desk)	✓ (all)	✓ (all)	✓ (all)	✗	✗	✓ (all)	✓ (all)	✓ (all)	✓ (all)
Modify Position	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗
Set Risk Limits	✗	✗	✗	✓	✓	✗	✗	✗	✗	✗	✓	✓
Override Risk Limits	✗	✗	✓ (temp)	✓ (temp)	✓	✗	✗	✗	✗	✗	✓	✓
View Audit Trails	✗	✗	✗	✓ (RO)	✓ (RO)	✗	✗	✗	✓ (RO)	✓ (RO)	✓ (RO)	✓ (RO)
Modify Audit Trails	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗
Deploy Code	✗	✗	✗	✗	✗	✗	✓ (staging)	✓ (prod)	✓ (all)	✗	✗	✗
Modify Config	✗	✗	✗	✗	✗	✗	✗	✓ (approval)	✓	✗	✗	✓
Access Prod DB	✗	✗	✗	✗	✗	✗	✗	✗	✓ (RO)	✗	✗	✗
Manage Users	✗	✗	✗	✗	✗	✗	✗	✗	✓	✗	✗	✓
Financial Reports	✗	✗	✓ (desk)	✓ (all)	✓ (all)	✓ (all)	✗	✗	✗	✓ (all)	✓ (all)	✓ (all)
Compliance Reports	✗	✗	✗	✗	✓	✗	✗	✗	✗	✓	✓	✓

Legend:

• ✓ = Allowed
• ✓ (limit) = Allowed with limits/constraints
• ✓ (RO) = Read-only access
• ✗ = Not allowed

---

Incompatible Role Combinations

These role combinations create conflicts of interest and MUST be prevented:

SOD-001: Trader + Risk Approver

• Role A: ROLE-TRADER, ROLE-SENIOR-TRADER, ROLE-TRADING-MANAGER
• Role B: ROLE-RISK-MANAGER, ROLE-CRO
• Reason: Trader cannot approve own risk limits or overrides
• Control: System enforces - trader's risk approvals require independent risk manager
• Exception Process: CFO approval required + compensating controls (dual approval, enhanced monitoring)

SOD-002: Order Creator + Order Approver (Same Account)

• Role A: ROLE-TRADER
• Role B: ROLE-SENIOR-TRADER (when approving for same account)
• Reason: Cannot create and approve same order
• Control: System checks - order creator ≠ order approver for same order_id
• Exception Process: NONE - No exceptions allowed (SOX Section 302)

SOD-003: Payment Initiator + Payment Approver

• Role A: ROLE-OPERATIONS
• Role B: ROLE-OPERATIONS-MANAGER
• Reason: Financial control separation (4-eyes principle)
• Control: Settlements > $100K require dual approval from Operations + CFO
• Exception Process: Dual approval from CFO + CEO required

SOD-004: Developer + Production Deployer

• Role A: ROLE-DEVELOPER
• Role B: ROLE-DEVOPS
• Reason: Developer cannot deploy own code
• Control: Code review + independent deployment (DevOps)
• Exception Process: CTO approval + independent code review required

SOD-005: Trader + P&L Calculator

• Role A: ROLE-TRADER, ROLE-SENIOR-TRADER, ROLE-TRADING-MANAGER
• Role B: ROLE-OPERATIONS (for P&L reconciliation)
• Reason: Trader cannot calculate own P&L
• Control: Independent P&L calculation by Operations
• Exception Process: CFO approval + dual calculation (Operations + Risk)

SOD-006: Config Modifier + Auditor

• Role A: ROLE-ADMIN, ROLE-DEVOPS, ROLE-CTO
• Role B: ROLE-AUDITOR
• Reason: Cannot audit own changes
• Control: External auditors are independent (not employees)
• Exception Process: NONE - Use external auditor

SOD-007: Audit Trail Owner + System User

• Role A: ROLE-DEVOPS (manages audit trail infrastructure)
• Role B: Any trading or operational role
• Reason: Audit trail admin cannot modify own audit entries
• Control: Audit trail is immutable (write-once), checksums prevent tampering
• Exception Process: NONE - Technical control enforces immutability

SOD-008: Financial Reporting + Trading

• Role A: ROLE-CFO, ROLE-OPERATIONS (for financial reporting)
• Role B: ROLE-TRADER, ROLE-SENIOR-TRADER, ROLE-TRADING-MANAGER
• Reason: Financial reporter cannot influence reported results
• Control: CFO and Operations cannot execute trades
• Exception Process: NONE - No exceptions allowed

---

Required Separations

SEP-001: Trade Execution Process

Process: Trade Lifecycle (Entry → Approval → Execution → Settlement)

Separated Functions:

1. Trade Entry: ROLE-TRADER (creates order)
2. Trade Approval: ROLE-SENIOR-TRADER or ROLE-TRADING-MANAGER (approves order)
3. Risk Check: ROLE-RISK-MANAGER (validates risk limits)
4. Execution: System (automated) or External Broker
5. Settlement: ROLE-OPERATIONS (reconciles and settles)

Justification: SOX 404 control requirement - no single person controls entire trade lifecycle

Testing: Quarterly - sample 25 trades, verify different actors for each step

---

SEP-002: Financial Reporting Process

Process: P&L Calculation and Reporting

Separated Functions:

1. Trade Data: ROLE-TRADER (generates trade data)
2. P&L Calculation: ROLE-OPERATIONS (calculates P&L)
3. Risk Calculation: ROLE-RISK-MANAGER (calculates VaR, Greeks)
4. Variance Analysis: ROLE-RISK-ANALYST (analyzes P&L vs. risk)
5. Report Approval: ROLE-CFO (certifies financial report)

Justification: SOX 302 certification requirement - independent P&L calculation

Testing: Monthly - recalculate P&L for sample period, verify variance < 0.1%

---

SEP-003: System Change Management

Process: Code Deployment

Separated Functions:

1. Code Development: ROLE-DEVELOPER (writes code)
2. Code Review: ROLE-SENIOR-DEVELOPER (reviews code, not original author)
3. Deployment Approval: ROLE-CTO (approves production deployment)
4. Deployment Execution: ROLE-DEVOPS (deploys to production)
5. Post-Deployment Validation: ROLE-CTO or ROLE-OPERATIONS (validates)

Justification: SOX 404 control requirement - change control

Testing: Quarterly - sample 10 deployments, verify separation

---

SEP-004: Access Management

Process: User Provisioning and Access Changes

Separated Functions:

1. Access Request: Manager (requests access for team member)
2. Access Approval: ROLE-CTO or ROLE-CFO (approves based on role)
3. Access Provisioning: ROLE-ADMIN (provisions access)
4. Access Review: ROLE-COMPLIANCE-OFFICER (quarterly review)

Justification: SOX 404 control requirement - access control

Testing: Quarterly - review all access changes, verify approvals

---

Exception Process

When Exceptions Are Allowed

1. Small Team Size: Company has < 10 employees, insufficient staff for full separation
2. Emergency Situations: Critical system failure requires immediate fix
3. Temporary Staffing Gaps: Key personnel on vacation/leave
4. Business Necessity: Legitimate business need with no alternative

Exception Requirements

All exceptions require:

1. Business Justification: Detailed explanation of why exception is necessary
2. Risk Assessment: Document risks introduced by SOD violation
3. Executive Approval: CFO/CEO approval required
4. Compensating Controls: Additional controls to mitigate risk
5. Time Limit: Exceptions are temporary (max 90 days)
6. Enhanced Monitoring: Increased audit logging and review
7. Documentation: All exceptions logged in SOX compliance system

Example Exception Process

Scenario: Only one DevOps engineer available, needs to deploy code they helped develop

Exception Request:

Exception ID: SOD-EXC-2024-001
Date Requested: 2024-12-15
Requested By: John Doe (CTO)

SOD Rule Violated: SOD-004 (Developer + Production Deployer)

Business Justification:
- DevOps engineer (Alice) is sole person with production access
- Critical bug fix needed for trade reconciliation
- Waiting for external help would delay 1 week
- Financial impact: $50K per day in reconciliation costs

Risk Assessment:
- Risk: Alice could deploy malicious or buggy code without review
- Probability: Low (Alice is trusted employee, 5 years tenure)
- Impact: High (production outage, financial loss)

Compensating Controls:
1. Independent code review by external consultant (Bob)
2. CTO (John) to be present during deployment (video call)
3. Enhanced logging of all deployment actions
4. Post-deployment review within 24 hours
5. Emergency rollback plan tested and ready

Time Limit: 7 days (until second DevOps engineer hired)

Approvals Required:
- CTO Approval: [Signature]
- CFO Approval: [Signature]
- CEO Approval: [Signature]

Status: APPROVED

Compensating Controls:

• Dual approval (CTO + CFO)
• Independent code review
• Real-time monitoring during deployment
• Post-deployment audit
• Enhanced logging (all actions by Alice)

Monitoring:

• Daily review of Alice's actions
• CFO notified of all production changes
• External audit of exception after 7 days

Termination:

• Exception expires after 7 days
• New DevOps engineer hired and trained
• SOD-004 control reinstated
• Post-exception audit conducted

---

Quarterly Review Process

Access Review Schedule

Q1 Review (January - March):

• Due Date: April 15
• Scope: All users, all roles
• Reviewer: Compliance Officer + CFO

Q2 Review (April - June):

• Due Date: July 15
• Scope: Privileged roles (Admin, DevOps, CTO, CFO, CEO)
• Reviewer: External Auditor

Q3 Review (July - September):

• Due Date: October 15
• Scope: All users, all roles
• Reviewer: Compliance Officer + CFO

Q4 Review (October - December):

• Due Date: January 15
• Scope: All users, all roles + Annual SOD assessment
• Reviewer: External Auditor + Audit Committee

Review Procedures

1. Generate Access Report

-- Query current user roles
SELECT
    u.user_id,
    u.username,
    u.email,
    ARRAY_AGG(r.role_name) as roles,
    u.last_login,
    u.status
FROM users u
JOIN user_roles ur ON u.user_id = ur.user_id
JOIN roles r ON ur.role_id = r.role_id
WHERE u.status = 'ACTIVE'
GROUP BY u.user_id, u.username, u.email, u.last_login, u.status
ORDER BY u.username;

2. Review Each User

• Is user still employed?
• Does user still need this access for their job?
• Are assigned roles appropriate for job function?
• Any SOD violations? (check against incompatible combinations)
• Last activity date (flag inactive users > 90 days)

3. Document Findings

User: alice@foxhunt.com
Current Roles: ROLE-TRADER, ROLE-RISK-ANALYST
Review Findings:
- ✓ User is active employee (Trader)
- ✓ ROLE-TRADER is appropriate for job function
- ✗ ROLE-RISK-ANALYST is not appropriate (SOD violation - trader cannot be risk analyst)
- Action Required: Remove ROLE-RISK-ANALYST
- Approved By: CFO
- Completed: 2024-04-10

4. Remediation

• Revoke inappropriate access within 5 business days
• Document rationale for access that is retained
• Flag SOD violations for executive review
• Update access control matrix

5. Certification

I, [Compliance Officer Name], certify that I have reviewed user access
as of [Quarter End Date] and:

1. All users have been reviewed for appropriate access
2. Inappropriate access has been removed
3. All SOD violations have been documented and addressed
4. No material weaknesses in access controls were identified

Date: [Date]
Signature: _______________________
[Compliance Officer Name]

Approved By:
CFO Signature: _______________________
Date: [Date]

---

Document Owner: Compliance Officer Approval: CFO, CTO, General Counsel Next Review Date: 2026-01-01