During a walkthrough of the change management process, an auditor observes that the 'Developer' role in the ERP system has access to 'Migrate to Production'. The IT Manager explains this is necessary for emergency fixes overnight when the Change Manager is unavailable. What is the auditor's BEST course of action?

Answer options:

Accept the explanation as a valid business requirement.

Recommend that the Developer role be removed entirely.

Identify this as a Segregation of Duties (SoD) deficiency and recommend a separate 'Emergency ID' with monitoring.

Require that the Change Manager work overnight shifts.

How to approach this question

Recognize the SoD conflict (Dev vs Prod) and select the standard audit recommendation for emergency access (Firecall/Emergency ID).

Full Answer

C.Identify this as a Segregation of Duties (SoD) deficiency and recommend a separate 'Emergency ID' with monitoring.✓ Correct

Allowing developers standing access to migrate code to production is a critical Segregation of Duties (SoD) failure. The standard solution for emergencies is a 'Firecall' or 'Emergency' ID that is checked out, monitored, and reviewed immediately after use.

Common mistakes

Accepting the client's explanation of 'business necessity' without requiring a compensating control.

Question 04 All questions Question 06

Practice the full CPA ISC Practice Exam 3

82 questions · hints · full answers · grading

More questions from this exam

Q01A CPA is advising a client who is migrating their legacy on-premise ERP system to a cloud-based s...Medium Q02During a review of a client's cloud governance structure, an auditor notes that the client uses a...Medium Q03An auditor is evaluating the 'Processing Integrity' principle for a financial institution's loan ...Hard Q04A company uses a batch processing system to update inventory records overnight. The 'Grandfather-...Hard Q06An auditor is reviewing a SQL query used to extract 'Active Customers' for a marketing report. Th...Hard

View all 82 questions →