An IS auditor finds that a DBA has read and write access to production data. The IS auditor should:

A.
accept the DBA access as a common practice.

B.
assess the controls relevant to the DBA function.

C.
recommend the immediate revocation of the DBA access to production data.

D.
review user access authorizations approved by the DBA.

Explanation:
It is good practice when finding a potential exposure to look for the best controls. Though granting the database
administrator (DBA) access to production data might be a common practice, the IS auditor should evaluate the
relevant controls. The DBA should have access based on a need-to-know and need-to-do basis; therefore,
revocation may remove the access required. The DBA, typically, may need to have access to some production
data. Granting user authorizations is the responsibility of the dataowner and not the DBA.