An IS auditor discovers that due to resource constraints, a database administrator (DBA) is responsible for developing and executing changes into the production environment. Which of the following…

Ensuring a change management process is followed is important, but identifying compensating controls is a more immediate and fundamental step to assess the current risk level of the known SoD violation.

The auditor has identified a potential segregation of duties (SoD) violation, where one person performs conflicting functions that could lead to fraud or error. Before reporting it as a definitive finding or recommending changes, the auditor must first determine if any existing compensating controls (e.g., independent review, automated logging, supervisory oversight) are in place to mitigate the inherent risk associated with this SoD conflict. This allows for an accurate assessment of the actual risk level.

Determining if another DBA could make the changes is a potential remediation, but it is premature before understanding if existing controls already mitigate the risk and to fully assess the current situation.

Reporting a potential SoD violation is the ultimate goal, but it should be done *after* assessing the full risk landscape, including the presence of compensating controls, to provide a comprehensive and actionable finding.