CRISC Certified in Risk and Information Systems ControlRisk Response and ReportingMedium
A multinational corporation is evaluating its control environment for financial reporting. An internal audit reveals that while access controls to the ERP system are robust, there is no formal process for reviewing user access rights when employees change roles or leave the company. This omission has led to several instances of former employees retaining access for weeks. Which type of control weakness does this scenario primarily represent?
- AAbsence of a detective control.
- BLack of a corrective control.
- CBreakdown in control monitoring.
- DIneffective preventive control.
Show answer & explanationAnswer & explanation
Correct answer: C. Breakdown in control monitoring.
The core issue is not the lack of a control type (preventive/detective/corrective) but the failure to properly operate or review existing controls (access rights) over time, which falls under control monitoring. The process for reviewing access rights is not active.
Why the other options are wrong
- A. A detective control (e.g., an audit log review for former employee access) might be absent or ineffective, but the primary failure is in the ongoing management of access, which includes monitoring.
- B. Corrective controls would address what happens after an unauthorized access is detected, but the problem here is the failure to detect or prevent the ongoing issue through monitoring.
- D. Preventive controls (like initial access grants) might be effective, but the monitoring of their continued appropriateness is failing.
Control Monitoring Breakdown
A failure in the ongoing processes designed to assess the presence, effectiveness, and continued operation of controls over time, leading to control deficiencies.
- Controls may be designed well but fail in execution or maintenance.
- Includes lack of regular reviews, audits, or checks.
- Can lead to controls becoming ineffective or outdated.
- Highlights the importance of continuous assurance activities.
Memory trick: Monitoring's Missing, Controls are Crumbling, Risks are Rising.