To provide additional clarity, a fundamental element of internal control is the segregation of certain key duties. The basic idea underlying "Segregation of Duty" is that no employee or group of employees should be in a position both to perpetrate and to conceal errors or fraud in the normal course of their duties.

Based on this concept, we did not know if the government felt there should be a segregation of duty between the entity that provides the company information to the Government, and the entity used the perform the risk calculation and provide the resulting risk indicator to the Government to be used for award decisions.

As an example, if D&B provides the company data, should the analysis be done using a different 3rd party risk analysis tool (e.g. iRAS) - or can we consider using the D&B risk indicator?

A14. The Government believes that one entity may provide data without a segregtion of duty regarding risk analysis. All entities are encouraged to respond and should a company feel that segregation of duties is valuable, should propose its idea.