ITPEC FE Morning April 2018 Question 59

Measures that keep the documents confidential — leakage, falsification and unauthorized use all begin with someone reaching documents they should not, so the audit checks confidentiality controls.

A system auditor picks checkpoints that match the risk being audited. The risk named here is that system documents (designs, specifications, manuals) leak, are altered or are used by people who should not have them. The control for that risk protects who can see and handle the documents: classification, access restrictions, secure storage, and controlled lending and disposal.

Answer (c)

Why not others:

• •(a) — producing documents even during prototype development is a completeness control, aimed at the risk of missing documentation
• •(b) — standardizing documents controls quality and consistency, not disclosure or tampering
• •(d) — updating documents promptly after system changes controls the risk of outdated, inaccurate documents

Key rule: Match each audit checkpoint to the risk it controls: leakage and unauthorized use point to confidentiality, missing documents to completeness, stale documents to accuracy.

System Audit · AI-written, may contain errors