Isaca Certified Information Systems Auditor CISA Question # 198 Topic 20 Discussion
CISA Exam Topic 20 Question 198 Discussion:
Question #: 198
Topic #: 20
An IS auditor discovers that due to resource constraints a database administrator (DBA) is responsible for developing and executing changes into the production environment Which ot the following should the auditor do FIRSTS
A.
Determine whether another DBA could make the changes
B.
Report a potential segregation of duties violation
C.
identify whether any compensating controls exist
D.
Ensure a change management process is followed prior to implementation
A database administrator (DBA) is responsible for maintaining the integrity, security and performance of the database systems. A DBA who is also responsible for developing and executing changes into the production environment may have a conflict of interest and pose a risk to the data quality and availability. Therefore, the IS auditor should first identify whether any compensating controls exist to mitigate this risk, such as independent reviews, approvals, audits or monitoring of the changes. Determining whether another DBA could make the changes, reporting a potential segregation of duties violation and ensuring a change management process is followed prior to implementation are possible actions that the auditor could take after identifying the compensating controls or the lack thereof. References:
DatabaseAdministrator (DBA) Definition
Segregation of Duties | ISACA
[Compensating Control Definition]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit