ITPEC FE Morning April 2019 Question 59

Confirming how access control over the data is managed — an auditor checks and evaluates controls that others have put in place.

A system auditor is independent of the audited area and does not run it. When auditing access control, the auditor gathers evidence (access rights tables, logs, approval records) and confirms whether the controls are designed and operated properly, then reports findings and recommendations. Creating, setting and operating the controls belong to the departments responsible for them.

Answer (a)

Why not others:

• •(b) — creating and storing an access control table is an administrative task of the system's owners; the auditor would review that table, not make it
• •(c) — establishing a management policy is a management responsibility; the auditor evaluates whether the policy is adequate
• •(d) — implementing operations management is the work of the operations staff; an auditor who ran it would end up auditing his own work

Key rule: Verbs such as confirm, verify and evaluate describe an auditor; create, establish and implement describe the audited side.

System Audit · AI-written, may contain errors