An internal audit has detected that a number of archived tapes are missing from secured storage.
There was no recent need for restoration of data from the missing tapes. The location is monitored
by access control and CCTV systems. Review of the CCTV system indicates that it has not been
recording for three months. The access control system shows numerous valid entries into the
storage location during that time. The last audit was six months ago and the tapes were accounted
for at that time. Which of the following could have aided the investigation?
A.
Testing controls
B.
Risk assessment
C.
Signed AUP
D.
Routine audits
This is a trick question which requires a good understanding of all concepts
• We are told that it was an internal AUDIT which detected the issue.
• This means that it was an audit that found the issue in the first place.
• And that if we had conducted an audit at a much earlier stage, we would have found the problem much earlier as well.
• So at face value, it appears that “D.Routine audits” is the correct answer. Only thing is, that there is a much better answer.
We need to therefore understand whata TEST CONTROL is.
A test of controls is an AUDIT PROCEDURE TO test the effectiveness of a CONTROL used by a client entity to prevent or detect material mismanagement. So a TEST CONTROL is a form of targeted AUDIT.
Testing controls come in three types: Technical, Management and Operational.
• In this Question, the CCTV system has not been recording for three months and no one noticed.
• Improved testing controls (regular testing to verify the CCTV system is recording) would ensure that the CCTV is recording as expected.
• The CCTV recordings could have aided the investigation into the missing tapes.
Lest now remove the clearly incorrect answers:
B. Risk assessment – This neither prevent people from stealing tapes, nor helps to find out who stole them. I
C. Signed AUP (Acceptable Use Policy) – – This neither prevent people from stealing tapes, nor helps to find out who stole them.
So the correct answers is between A and D., with A being the most tailored made answer
0
0