Isaca Updated CISA Exam Questions and Answers by nikita

A database administrator (DBA) is responsible for maintaining the integrity, security and performance of the database systems. A DBA who is also responsible for developing and executing changes into the production environment may have a conflict of interest and pose a risk to the data quality and availability. Therefore, the IS auditor should first identify whether any compensating controls exist to mitigate this risk, such as independent reviews, approvals, audits or monitoring of the changes. Determining whether another DBA could make the changes, reporting a potential segregation of duties violation and ensuring a change management process is followed prior to implementation are possible actions that the auditor could take after identifying the compensating controls or the lack thereof. References:

 DatabaseAdministrator (DBA) Definition

 Segregation of Duties | ISACA

[Compensating Control Definition]

Asking management why the regulatory changes have not been included is the first thing that an IS auditor should do during the planning stage of a compliance audit. An IS auditor should inquire about the reasons for not updating the inventory of compliance requirements with recent regulatory changes related to managing data risk. This will help the IS auditor to understand whether there is a gap in awareness, communication, or implementation of compliance obligations within the organization. The other options are not the first things that an IS auditor should do, but rather possible subsequent actions that may depend on management’s response. References:

CISA Review Manual (Digital Version), Chapter 2, Section 2.31

CISA Review Questions, Answers and Explanations Database, Question ID 214

The correct answer is D. Implement compensating controls.

When an organization has budget constraints, it may not be practical to hire additional employees to fully separate incompatible duties. In that situation, the best approach is to implement compensating controls that reduce the risk created by inadequate separation of duties.

Examples of compensating controls include independent management review, activity log review, exception reporting, approval workflows, periodic access reviews, reconciliation by someone independent of the transaction process, monitoring of privileged activity, and detective controls over high-risk actions.

ISACA defines segregation/separation of duties as a basic internal control that prevents or detects errors and irregularities by assigning incompatible responsibilities to separate individuals. ISACA also defines a compensating control as an internal control that reduces the risk of an existing or potential control weakness resulting in errors and omissions.

Option A is not the best answer because hiring temporary staff may not be affordable and may create training, supervision, and access-control issues.

Option B is not the best answer because an independent audit may detect problems, but it does not itself resolve the separation of duties weakness.

Option C may help reduce long-term dependency on one person and may improve fraud detection, but job rotation alone does not adequately address incompatible duties if the same person can still perform conflicting functions during a given period.

Therefore, under budget constraints, the most practical and effective answer is to implement compensating controls.

 The audit charter is the document that defines the purpose, authority and responsibility of the IS audit function. It provides IS audit professionals with the best source of direction for performing audit functions, as it establishes the scope, objectives, reporting lines, independence, accountability and resources of the IS audit function. The IT steering committee is a governance body that oversees the strategic alignment, prioritization and direction of IT initiatives, but it does not provide specific guidance for IS audit functions. The information security policy is a document that defines the rules and principles for protecting information assets in the organization, but it does not cover all aspects of IS audit functions. Audit best practices are general guidelines and recommendations for conducting effective and efficient audits, but they are not binding or authoritative sources of direction for IS audit functions. References: CISA Review Manual (Digital Version) 1, Chapter 1: Information Systems Auditing Process, Section 1.1: Audit Charter.