An internal auditor identified a database administrator with an incompatible dual role. Which of the following duties should not be performed by the identified administrator?

This scenario represents a classic violation of the segregation of duties (SoD). The database administrator (DBA) has a custodial and administrative role over the database asset. Preparing input data is a transactional, operational user function. Allowing the DBA to also input data creates a conflict where they could introduce unauthorized or fraudulent data and then use their administrative privileges to alter logs or conceal the activity, bypassing critical controls.

A. Designing and maintaining the database are both core, compatible functions of a database administrator role and do not represent an SoD conflict.
C. Maintaining the database and ensuring its security are fundamental and interrelated responsibilities of a DBA, not an incompatible dual role.
D. Designing the database and providing for its security are complementary duties typically assigned to the DBA function.

1. ISACA. (2019). COBIT 2019 Framework: Governance and Management Objectives. In objective APO13 (Managed Security), the framework emphasizes the need for segregation of duties to reduce the risk of fraud and error. Combining data input (user function) with database administration (privileged function) is a key example of a conflict.

2. Weber, R. (2012). Information Systems Control and Audit (3rd ed.). Pearson. Chapter 14, "Auditing Computerized Information Systems," details SoD within the IT function, explicitly stating that personnel who administer databases should be segregated from those who enter data into applications (pp. 485-487).

3. Hall, J. A. (2018). Information Technology Auditing (4th ed.). Cengage Learning. In Chapter 3, "Auditing the IT Governance Process," the text identifies the separation of database administration from data entry and systems development as a critical control (p. 102).