Skip to content

CS Professional · Internal and Forensic Audit · Emerging Issues and Challenges

Internal auditors of Himalaya Finserv Ltd find that its payment application developer can also move code to production and approve his own changes without independent review. Production data shows an unexplained change to a vendor bank account field. Which is the most appropriate audit conclusion and recommendation?

The conclusion is a segregation of duties failure in change management. The developer should not deploy or approve his own code; the company should enforce independent approval, separate development and production access, and review vendor-master change logs to investigate the unexplained bank account change.

  1. ASegregation of duties failure in change management; enforce independent approval and separate development from production access, and review the vendor-master change logsCorrect
  2. BAcceptable arrangement because developers know the system best; no action needed
  3. COnly a hardware issue; recommend purchasing new servers
  4. DA matter for the statutory auditor alone; internal audit should not report it

Explanation

One person developing, approving and deploying code defeats segregation of duties and allows unauthorised changes, which fits the suspicious vendor bank change. The fix is independent approval, separate environments and review of logs. The other options ignore the control failure or wrongly limit internal audit's reporting role.

Did you get it right without looking?

One question tells you little. A timed set on Emerging Issues and Challenges shows your real accuracy, how long you take and where you lose marks.

Practise Emerging Issues and ChallengesFree diagnostic mock

More Emerging Issues and Challenges questions