Skip to content

CMA Final · Cost and Management Audit · Information Systems Security Audit

An auditor finds that a cost accounting application's database administrator can also approve journal entries and delete audit log records. Which finding is the most serious from an IS security perspective?

The most serious finding is the ability to delete audit logs. A privileged administrator who can also approve entries could erase evidence of misuse, destroying accountability and defeating detective controls. Weak passwords, missing screen timeouts and absent manuals are weaknesses, but none removes the audit trail itself.

  1. AAbility to delete audit logs, because it can conceal unauthorised activity and defeat detective controlsCorrect
  2. BUse of a six-character password by clerks
  3. CAbsence of a screen saver timeout on one workstation
  4. DLack of a printed user manual

Explanation

A privileged user who can delete audit logs can erase evidence of own actions, undermining accountability and all detective controls; combined with approval rights it enables undetected fraud. The other findings are real but lower in impact and do not remove the audit trail.

Did you get it right without looking?

One question tells you little. A timed set on Information Systems Security Audit shows your real accuracy, how long you take and where you lose marks.

Practise Information Systems Security AuditFree diagnostic mock

More Information Systems Security Audit questions