ITPEC FE Subject A April 2025 Question 45
Which of the following is a checkpoint for auditing the control of risks related to information leakage and unauthorized use of documents concerning a system?
Explanation
Measures that keep the documents confidential — leakage and unauthorized use are confidentiality risks, so the audit checks confidentiality controls.
A system auditor picks checkpoints that match the risk being audited. The risk named here is that system documents (designs, specifications, manuals) leak or are used by people who should not have them. The control for that risk protects who can see and use the documents: classification, access restrictions, secure storage, and controlled lending and disposal.
Answer (c)
Why not others:
- •(a) — producing documents even during prototype development is a completeness control, aimed at the risk of missing documentation
- •(b) — standardizing documents controls quality and consistency, not disclosure
- •(d) — updating documents promptly after system changes controls the risk of outdated, inaccurate documents
Key rule: Match each audit checkpoint to the risk it controls: leakage and unauthorized use point to confidentiality, missing documents to completeness, stale documents to accuracy.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.