ISACA Certified Information Systems Auditor (CISA) ExamDomain 3: Information Systems Acquisition, Development and ImplementationMedium
An IS auditor is evaluating controls over system development for a new financial application. The auditor observes that developers have direct write access to the production environment during development phases for 'quick fixes' and testing. Which of the following is the PRIMARY control weakness identified?
- AInadequate segregation of duties.
- BAbsence of a dedicated test environment.
- CLack of proper change management procedures.
- DInsufficient logging and monitoring.
Show answer & explanationAnswer & explanation
Correct answer: A. Inadequate segregation of duties.
Developers having direct write access to a production environment fundamentally violates the principle of segregation of duties, as it allows individuals to both develop and implement code in a live system without independent review or control. This creates a significant risk of unauthorized or erroneous changes.
Why the other options are wrong
- B. An absence of a dedicated test environment is a contributing factor, but the direct write access to production is a more fundamental SoD failure.
- C. While related, the direct access itself is a breakdown of SoD, which underlies many change management issues.
- D. Logging and monitoring would help detect issues, but they don't prevent the unauthorized access or changes from occurring.
Segregation of Duties (SoD)
Segregation of Duties (SoD) is a control principle designed to prevent fraud and errors by distributing critical tasks among different individuals.
- No single person should control an entire transaction.
- Reduces opportunity for unauthorized actions.
- Applies to both manual and automated processes.
Memory trick: Developers Don't Touch Production Directly.