Which of the following controls should an IS auditor recommend for a small organization where a single employee performs the combined functions of server operator and application programmer?

The correct answer is C. Implement automated logging and monitoring of changes made to development libraries. Automated logging and monitoring of changes made to development libraries provides compensating control when separation of duties is not feasible, enabling management and auditors to detect unauthorized or inappropriate changes performed by the individual with combined…

Submitted by parkjh· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Options

ARequire approval on all change requests prior to deployment.
BHire additional technical staff in order to force separation of duties.
CImplement automated logging and monitoring of changes made to development libraries.
DImplement automated controls to prevent the operator logon ID from making program

How the community answered

(22 responses)

A
9% (2)
B
23% (5)
C
64% (14)
D
5% (1)

Explanation

Automated logging and monitoring of changes made to development libraries provides compensating control when separation of duties is not feasible, enabling management and auditors to detect unauthorized or inappropriate changes performed by the individual with combined responsibilities.

Topics

#Separation of Duties#Detective Controls#Risk Mitigation#Change Management

Community Discussion

No community discussion yet for this question.

Full CISA Practice