Insider risk in a public agency: separation of duties and monitoring

Reference article · 5 min read

Insider risk in government rarely looks like the training video version. The realistic cases are mundane. A payroll clerk can both enter a pay rate change and approve it. An analyst copies a case folder to a personal drive during a final two weeks. A records clerk runs a name because a neighbor asked. None of it is sophisticated. It happens because one person holds more rights than the job needs, and because nobody reads the log.

That is good news for a small agency. You do not need a threat hunting team. You need a short list of transactions where one person should never act alone, monitoring narrow enough to survive a grievance, and offboarding that runs on time.

Start from transactions, not from people

Insider programs go wrong when they begin by profiling employees. Start instead with the transactions that move money, change a person's status, or expose protected records, and ask who can complete each one alone. Where the answer is one person, you have a gap.

• Vendor master and payment release. Editing a vendor's banking details, then releasing payment to it.
• Payroll master file changes. Pay rates and direct deposit accounts maintained by the person who approves time.
• Utility billing adjustments. Write-offs, penalty waivers, and account credits entered without a second look.
• Records and query systems. Criminal history, driver records, protection orders, case files, benefits records.
• Identity administration. An administrator who can create an account, grant it a role, use it, and clear the trail.

Where separation of duties belongs

Separation of duties divides a transaction so finishing it takes two people. Agencies that cannot split everything have three patterns, in order of preference.

1. Split the transaction. One person initiates, another approves, and roles enforce it rather than habit. Use this for payments and payroll changes.
2. Compensating review. Where headcount does not allow a split, route a change report to someone outside the process, such as a finance director or clerk, who would notice an entry that does not belong.
3. Threshold rules. Let low-value adjustments pass with one approval and require a second above a threshold set by policy.

Records queries need a different control: a purpose code on each query, supervisory review of a sample, and a rule against running yourself, family, or coworkers.

Monitoring that is proportionate and lawful

Concentrate on transactional monitoring: query logs in the records system, change logs in finance and payroll, adjustment reports in utility billing, privileged action logs in the identity platform. These show what someone did with agency data while doing their job, which is far easier to justify than general employee surveillance.

Keystroke logging, screen capture, monitoring of personal devices, and off-duty social media review sit in different territory. Depending on the state, electronic monitoring may require advance written notice, may be a mandatory subject of bargaining for represented employees, and may create disclosable records. Those rules vary and change, so settle scope with counsel and labor relations first.

• Give notice in advance. Acceptable use policy, logon banner, signed acknowledgment at onboarding.
• Log criminal justice queries. The federal CJIS Security Policy and state user agreements generally require logging and auditing of access to criminal justice information and treat misuse as a punishable offense. The policy is revised periodically, so confirm current obligations with your state CJIS Systems Officer.
• Review by exception. Alert on self-lookups, same surname matches, off-hours queries, dormant vendor reactivation, and adjustments over threshold, rather than browsing logs at will.
• Protect the audit trail. Limit who can read it, and match retention to your records schedule.

Run the program with HR and counsel

An insider program owned only by IT stalls the first time a real case appears. Stand up a small group: HR, agency counsel, IT and security, finance or internal audit, and labor relations where a bargaining unit is involved. Agree in writing, before the first case, on what triggers an inquiry, who is notified, how evidence is preserved, who decides whether to involve law enforcement, and how an employee is treated meanwhile. A process applied the same way every time survives an appeal.

Offboarding closes the widest window

The highest risk period runs from the moment someone knows they are leaving until their access is gone.

• One trigger. The HR separation action drives access removal and reassignment of approval authority. Do not depend on a supervisor remembering to email IT.
• Same day, everywhere. Network, email, VPN, MFA tokens, line of business systems, departmental cloud services, badge, devices, and shared passwords the person knew.
• Treat the notice period as elevated. For sensitive roles, consider read-only rights and no bulk export between notice and last day.
• Check for data movement. Review mailbox forwarding rules, large downloads, and removable media use for departing staff in sensitive roles, under written policy.

What to ask vendors, and how to start

When buying or renewing a finance, payroll, billing, HR, or records system, ask for demonstrations rather than assurances. Can roles be set so the same user cannot both initiate and approve, in our own configuration? What is logged by default, can an administrator alter the log, and can we export it in a machine readable format? How do vendor support staff reach production data, and are those sessions logged?

In the contract, require audit log retention and export at no added charge, state that log data is agency data returned at termination, and require logging of vendor remote access. To start, pick five transactions, map who can complete each alone, fix the two worst, and write the offboarding trigger.

HQT works with state and local agencies on access design, audit logging, and security engineering for the systems where these controls live.

Frequently asked questions