During an assurance engagement, an internal auditor identified that a developer of the organization's enterprise resource planning (ERP) system had intentionally modified the production code to…

Question

Options

• ASegregate duties between code development and migrating changes into production.
• BConduct fraud training for the IT team responsible for the ERP system.
• CPenalize the developer who committed the fraud by terminating employment.
• DRestrict developers' access to the ERP system's test environment.

• A
  11% (5)
• B
  4% (2)
• C
  7% (3)
• D
  78% (36)

Explanation

Note: The provided answer key appears to be incorrect. Option A is the correct answer based on established IT audit principles, and I want to be transparent about this rather than rationalize a wrong answer.

Why A is correct: Segregating duties between code development and migrating changes into production is the direct preventive control here - if the developer who writes code cannot also deploy it to production, they cannot unilaterally introduce fraudulent transactions. This is the textbook IT general control (ITGC) that addresses this exact scenario.

Why D is wrong (and unlikely to be correct): Restricting developers' access to the test environment is counterproductive - developers need test access to do their jobs. It also does nothing to prevent access to the production environment, which is where the fraud occurred. This confuses the direction of the control.

Why B and C are wrong: Fraud training (B) is a detective/deterrent measure, not a preventive control - it cannot stop a determined fraudster. Termination (C) is a reactive consequence after the fact, not a future-facing control activity.

Memory tip: For IT fraud prevention questions, always ask: "Who has both the ability to make a change AND deploy it to production?" When one person controls both, fraud is easy. Segregation of duties (SOD) breaks that power by requiring a second person for production deployment - remember SOD = separation of capability + authority.

If this question comes from a practice bank or study guide, I'd recommend flagging it, as the answer key contradicts standard CISA/IIA guidance.

No community discussion yet for this question.