ITPEC FE Morning October 2022 Question 60

Viewing the access control rules for data — an auditor examines the controls; others design and run them.

To audit access control, the system auditor inspects evidence such as the access rules, user privileges and access logs, and judges whether the controls are appropriate and working as intended. The auditor must be independent of what is audited, so creating, establishing or operating the controls is left to management and the IT department.

Answer (d)

Why not others:

• •(a) — creating and storing access control records is an operational task of the system administrators; the auditor reviews those records as evidence
• •(b) — establishing an access control policy is a management decision; the auditor evaluates whether the policy is adequate
• •(c) — implementing the procedures is the job of the operations staff; an auditor who did it would be auditing his own work

Key rule: Auditors examine, evaluate and recommend; any option in which the auditor creates, establishes or implements a control breaks the independence the audit depends on.

System Audit · AI-written, may contain errors