Certified Information Systems Auditor (CISA) — Question 694

An IS auditor observes that a large number of departed employees have not been removed from the accounts payable system. Which of the following is MOST important to determine in order to assess the risk?

Answer options

• A. The ability of departed employees to actually access the system
• B. The frequency of user access reviews performed by management
• C. The process for terminating access of departed employees
• D. The frequency of intrusion attempts associated with the accounts payable

Correct answer: A

Explanation

The most critical factor is the ability of departed employees to access the system, as it directly affects security. If they still have access, they could potentially misuse sensitive information. While the other options relate to access management, they do not address the immediate risk posed by the existing access of former employees.