Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Information Systems

An IS auditor wants evidence that a financial application's access rights match approved job roles. Which audit procedure gives the most direct evidence of this?

The most direct evidence comes from comparing the system's actual user access list with HR-approved role authorisations. This tests whether real permissions match approved roles. Interviews give only management's statements, while brochures and server counts have no bearing on whether access rights are appropriate.

  1. AComparing the system's user access list with HR-approved role authorisationsCorrect
  2. BInterviewing the IT head about the access policy
  3. CReviewing the vendor's marketing brochure
  4. DChecking the number of servers in the data centre

Explanation

Reconciling actual user access in the system against approved role authorisations tests the control directly and gives reliable, independent evidence. Interviews only give representations, a brochure is irrelevant, and counting servers says nothing about access rights.

Did you get it right without looking?

One question tells you little. A timed set on Information Systems shows your real accuracy, how long you take and where you lose marks.

Practise Information SystemsFree diagnostic mock

More Information Systems questions