ACCA Strategic Professional · Strategic Business Leader · IT systems security and control
Brightwater Bank finds that a former employee's user account remained active for four months after leaving and was used to view customer records. Which IT general control failure is most directly demonstrated, and what should the bank implement?
This is a logical access control failure within IT general controls. The bank should connect HR leaver notifications to immediate account deactivation and carry out regular user access reviews, so former staff cannot reach customer data.
- AWeak backup procedures; introduce daily offsite backups
- BPoor logical access administration; link HR leaver notifications to prompt account deactivation and run periodic access reviewsCorrect
- CInadequate application output controls; add report sequence numbering
- DInadequate data input checks; add check digits to customer numbers
Explanation
An active leaver account is a logical access management failure, a core general control. Linking HR leaver processes to access removal and reviewing user lists periodically prevents recurrence. Backups, output and input checks do not address unauthorised access by former staff.
Did you get it right without looking?
One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.
More IT systems security and control questions
- Orchid Retail's board learns that a disgruntled systems administrator, who still holds privileged access after being passed over for promoti…
- Orrin Engineering takes nightly backups to disks stored in the same server room as the production servers. After a ransomware attack that al…
- Falcon Pharma discovers that attackers entered through a trusted software supplier's update, remained undetected for months, and quietly ext…
- Karima Health, a clinic group, finds that a lost unencrypted laptop holds patient records. The board wants to avoid recurrence through an in…
- Lumen Foods processes customer orders through an online system. To ensure that every order accepted is processed once and none is lost betwe…
- Brightpath Bank has a data protection officer reporting to the head of IT, who also decides how customer data is processed in new systems. A…