Our CU has a CLO and VP of Lending who act as administrators on our lending system (Temenos). They have authority to make all changes to automated lending rules in the system, to add or change user rights for staff and have lending authority to approve any loan in the system. They collaborate on these functions but both of them have access to do any of those things individually in the system (I.e. there is no override required to change these things in the system). I gave them a finding to segregate these functions but they are pushing back by saying that they would have all of these roles in effect regardless, even if they weren't the ones entering them into the lending system.
Does anyone have any sort of reference for me as to why these functions should be separated from lending authority? Or are they right and these things don't need to be separated?
