An IS auditor attempting to determine whether access to program documentation is restricted to
authorized persons would MOST likely:

A.
evaluate the record retention plans for off-premises storage.

B.
interview programmers about the procedures currently being followed.

C.
compare utilization records to operations schedules.

D.
review data file access records to test the librarian function.

Explanation:
Asking programmers about the procedures currently being followed is useful in determining whether
access to program documentation is restricted to authorized persons. Evaluating the record
retention plans for off-premises storage tests the recovery procedures, not the access control over
program documentation. Testing utilization records or data files will not address access security over
program documentation.