ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
A CISA is auditing an organization's IT organizational structure. The CISA observes that the database administrators (DBAs) also perform system administration functions, including managing operating system patches and network configurations on the database servers. Which of the following is the MOST significant concern for the CISA?
- ADifficulty in cross-training other IT staff for these roles.
- BLack of specialized expertise in both roles from a single person.
- CViolation of segregation of duties (SoD) principles.
- DPotential for increased workload and burnout among DBAs.
Show answer & explanationAnswer & explanation
Correct answer: C. Violation of segregation of duties (SoD) principles.
Combining DBA and system administration functions for the same servers violates the principle of segregation of duties. This creates a situation where a single individual has excessive control over critical data and the systems protecting it, increasing the risk of fraud, error, or malicious activity going undetected.
Why the other options are wrong
- A. Cross-training challenges are an HR/operational issue, not the most significant security or control risk.
- B. While specialized expertise is beneficial, the primary concern from an audit perspective is the control breakdown, not necessarily the skill level of the individual.
- D. Increased workload is an operational concern, not the primary governance or security risk.
Segregation of Duties (SoD)
A control principle that divides critical functions and responsibilities among different individuals to prevent any single person from having complete control over a process, thereby reducing the risk of fraud, error, or misuse.
- Prevents conflicts of interest.
- Requires multiple individuals to complete a task.
- Commonly applied in financial and IT processes.
Memory trick: Two sets of hands make it harder for one to steal the cookie.