An IS auditor observes a weakness in the tape management system at a data center in that some
parameters are set to bypass or ignore tape header records. Which of the following is the MOST
effective compensating control for this weakness?
A.
Staging and job set up
B.
Supervisory review of logs
C.
Regular back-up of tapes
D.
Offsite storage of tapes
Explanation:
If the IS auditor finds that there are effective staging and job set up processes, this can be
accepted as a compensating control. Choice B is a detective control while choices C and D are
corrective controls, none of which would serve as good compensating controls.