A small startup organization does not have the resources to implement separation of duties. Which of the following is the MOST effective compensating control?

The correct answer is B. Additional management reviews and reconciliations. When separation of duties cannot be implemented due to limited resources, enhanced management reviews and reconciliations serve as the most effective compensating control. These reviews provide oversight and independent verification of activities, reducing the risk of…

Submitted by lukas.cz· Apr 18, 2026Governance and Management of IT

Question

Options

AMandatory vacations
BAdditional management reviews and reconciliations
CThird-party assessments
DRotation of log monitoring and analysis responsibilities

How the community answered

(35 responses)

A
6% (2)
B
60% (21)
C
26% (9)
D
9% (3)

Explanation

When separation of duties cannot be implemented due to limited resources, enhanced management reviews and reconciliations serve as the most effective compensating control. These reviews provide oversight and independent verification of activities, reducing the risk of undetected errors or fraud.

Topics

#Compensating Controls#Separation of Duties#Internal Controls#Resource Constraints

Community Discussion

No community discussion yet for this question.

Full CISA Practice