The CIO of an organization has decided to assign the responsibility of internal IT audit to the IT team. This is consider a bad practice MAINLY because

Question

Options

• AThe IT team is not familiar in IT audit practices
• BThis represents a bad implementation of the Least Privilege principle
• CThis represents a conflict of interest
• DThe IT team is not certified to perform audits

• A
  9% (5)
• B
  13% (7)
• C
  75% (40)
• D
  2% (1)

Explanation

Assigning internal IT audit responsibilities to the IT team creates a conflict of interest because auditors must independently evaluate the very systems and processes they themselves manage - this is like asking someone to grade their own exam. Effective auditing requires objectivity and independence, which is impossible when auditors are reviewing their own work or that of their direct colleagues.

Why the distractors are wrong:

• A - Familiarity isn't the core issue; even a highly skilled IT team member cannot objectively audit their own environment.
• B - Least Privilege governs access rights (limiting permissions to what's needed for a role), not audit assignment; this scenario doesn't violate that principle.
• D - Certification may or may not be relevant depending on the organization, and is a secondary concern compared to the structural independence problem.

Memory tip: Think of the phrase "You can't audit what you own." Auditing requires a separation of duties - the auditor must be independent of the function being audited. Whenever an exam question involves someone reviewing their own work or department, the answer almost always points to conflict of interest.

No community discussion yet for this question.