ISC2 CISSP (Certified Information Systems Security Professional)Security Assessment and TestingMedium
A security auditor is reviewing an organization's change management process. They discover that a critical firewall rule modification was implemented without proper approval from the change advisory board (CAB) and without an associated risk assessment. Which of the following types of audit findings BEST describes this situation?
- AMaterial Weakness
- BObservation
- CSignificant Deficiency
- DControl Exception
Show answer & explanationAnswer & explanation
Correct answer: C. Significant Deficiency
A significant deficiency indicates a control weakness that is less severe than a material weakness but still important enough to merit attention by those charged with governance. Implementing a critical firewall rule without proper approval and risk assessment represents a significant breakdown in the change management process, directly impacting the organization's security posture.
Why the other options are wrong
- A. A material weakness is more severe, indicating that there is a reasonable possibility that a material misstatement of the entity's financial statements will not be prevented or detected, or a significant security breach will occur due to control failure. While serious, this single instance might not reach the 'material' threshold without further context, though it's close.
- B. An observation is typically a minor issue or an area for improvement, not a breakdown in a critical control.
- D. A control exception is a specific instance where a control did not operate as intended, but 'significant deficiency' categorizes the broader impact of this exception within the control environment.
Significant Deficiency
A flaw in an organization's internal control over financial reporting or security that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight.
- Indicates a breakdown in a control process.
- Less severe than a material weakness, but still serious.
- Requires attention from management and governance.
Memory trick: Auditors find FLAWED CONTROLS, ranging from minor OBSERVATIONS to serious MATERIAL WEAKNESSES.