Skip to content

CMA Final · Cost and Management Audit · Information Systems Security Audit

During an IS audit of a manufacturing company's ERP, the auditor wants to confirm that a programmer cannot both modify production code and move it into the live environment. Which security principle is being tested?

The principle being tested is segregation of duties. Separating the roles of changing program code and releasing it into the live environment ensures no single person can introduce unauthorised or fraudulent changes unchecked. Encryption, normalisation and continuity planning serve other objectives and do not address this conflict of roles.

  1. ASegregation of dutiesCorrect
  2. BData normalisation
  3. CBusiness continuity planning
  4. DEncryption of data in transit

Explanation

Preventing one person from both developing/changing code and migrating it to production is a classic segregation of duties control. It reduces the risk of unauthorised or fraudulent changes. Encryption, normalisation and continuity planning address different objectives.

Did you get it right without looking?

One question tells you little. A timed set on Information Systems Security Audit shows your real accuracy, how long you take and where you lose marks.

Practise Information Systems Security AuditFree diagnostic mock

More Information Systems Security Audit questions