During an audit, the IS auditor finds that in many cases excessive rights were not removed from a system. Which of the following is the auditor's BEST recommendation?

While IT security is involved in access management, their primary role is to enforce policies, not necessarily to independently identify and revoke excessive rights without input from those who understand job roles.

System administrators ensure the technical implementation and consistency of assigned rights, but they don't typically have the business context to determine if a right is "excessive" for a specific user's role.

HR deleting access rights of terminated employees addresses a specific scenario (terminations) but does not address the broader issue of excessive rights for active employees or changes in roles.

Line management is best positioned to regularly review and request modifications of access rights because they have direct knowledge of an employee's current job function and required system access, making them responsible for ensuring rights are appropriate and not excessive. This periodic review helps to detect and remove unnecessary privileges that may have accumulated over time, aligning access with the principle of least privilege.