CMA Final · Cost and Management Audit · Information Systems Security Audit
Which of the following best describes the purpose of a 'segregation of duties' control in a computerised cost accounting environment?
Segregation of duties ensures that no single person can both initiate and approve or record a sensitive transaction, which reduces the chance of fraud and undetected error. It is distinct from encryption, off-site backup or operating-hour limits, which address confidentiality and availability instead.
- AEnsuring no single person can both initiate and approve or record a sensitive transactionCorrect
- BEncrypting data while it travels across the network
- CKeeping a duplicate copy of master files at an off-site location
- DLimiting the number of hours a system can run each day
Explanation
Segregation of duties divides incident-critical functions such as initiating, authorising and recording among different people to reduce fraud and error risk. Encryption protects data in transit, off-site copies support recovery, and run-time limits are unrelated to this control.
Did you get it right without looking?
One question tells you little. A timed set on Information Systems Security Audit shows your real accuracy, how long you take and where you lose marks.
More Information Systems Security Audit questions
- An auditor finds that a cost accounting application's database administrator can also approve journal entries and delete audit log records. …
- Which of the following is an example of an application control rather than a general IT control?
- During an IS security audit at a manufacturing company in Pune, the auditor finds that several former employees' user IDs remain active in t…
- During an IS audit of a manufacturing company's ERP, the auditor wants to confirm that a programmer cannot both modify production code and m…
- An auditor reviewing a company's ERP finds that the same employee can create a vendor master record, approve purchase orders to that vendor …
- In an information systems security audit, which control is a preventive control rather than a detective or corrective one?