An IS auditor observes a weakness in the tape management system at a data center in that some
parameters are set to bypass or ignore tape header records. Which of the following is the MOST
effective compensating control for this weakness?

A.
Staging and job set up

B.
Supervisory review of logs

C.
Regular back-up of tapes

D.
Offsite storage of tapes

Explanation:
If the IS auditor finds that there are effective staging and job set up processes, this can be accepted
as a compensating control. Choice B is a detective control while choices C and D are corrective
controls, none of which would serve as good compensating controls.