A CISA is evaluating an organization's IT organizational structure. The CISA discovers that a single individual is responsible for developing, testing, and deploying critical business application code, as well as managing the production database. What is the MOST significant risk associated with this arrangement?
- AOpportunities for fraud, errors, or unauthorized changes are significantly increased.
- BThe development lifecycle for new features will be excessively long.
- CThe organization may struggle to attract and retain skilled IT personnel.
- DThe individual may experience burnout due to an excessive workload.
Show answer & explanationAnswer & explanation
Correct answer: A. Opportunities for fraud, errors, or unauthorized changes are significantly increased.
This scenario describes a severe lack of segregation of duties (SoD). Allowing one person to control development, testing, deployment, and production database management creates an environment where malicious acts, errors, or unauthorized changes could occur undetected and unprevented, leading to significant integrity and security risks.
Why the other options are wrong
- B. While development might be slow, the immediate and most critical risk from a control perspective is the heightened potential for unauthorized activity or undetected errors.
- C. Retention is an HR issue, not the immediate and most significant control risk presented by a lack of SoD.
- D. Burnout is a human resources issue, but not the primary security and control risk of this organizational structure.
Segregation of Duties (SoD)
Segregation of Duties (SoD) is a control principle that divides critical functions among multiple individuals to prevent any single person from having complete control over a process, thereby reducing the risk of fraud, error, and unauthorized actions.
- Prevents a single point of failure and control.
- Reduces opportunities for fraud and errors.
- Requires multiple individuals for critical tasks.
Memory trick: One person with all the keys can unlock any door, for good or ill.