Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Brightwater Hospital's finance clerk was moved to the payroll team and still has access to the supplier master file, which allows creation of suppliers. Payroll staff can also approve payments. The internal auditor says the main weakness is a failure to apply the principle of least privilege and segregation of duties. Which action best addresses this?

The best action is to remove access no longer needed on role transfer and separate supplier creation from payment approval. This applies least privilege and segregation of duties. Encryption, stronger passwords or firewalls do not stop an authorised user from holding incompatible rights.

  1. AReview user access rights on transfer, remove rights no longer needed, and separate supplier creation from payment approvalCorrect
  2. BEncrypt the supplier master file at rest
  3. CRequire all staff to use longer passwords
  4. DInstall additional firewalls between the finance and payroll networks

Explanation

Least privilege means users hold only the access their current role requires, and segregation of duties prevents one person controlling incompatible functions such as creating suppliers and approving payments. Encryption, password length and firewalls do not remove excessive authorised rights held by an insider.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions