Exam CISA topic 1 question 250 discussion

The implementation team's lack of access to modify source code shows one aspect of the separation of duties in place, but it is not a complete proof of separation of duties. Simply not having access does not ensure that other processes (e.g. code reviews and approval processes) are in place. Separation of duties is not just about having separate roles, but also includes checks between each role, which makes it even more important that code reviews are performed.

cannot be A because it describes 4 eyes principle, and not separation of duties.

Apologies. Correct is B

Option D, where the developer approves changes prior to moving them to the change folder, is not an effective way of implementing separation of duties since it does not involve a separate individual verifying the code changes. This approach can lead to situations where the developer approves their own changes, increasing the risk of errors or malicious activity going undetected. Option C, where the implementation team does not have experience writing code, is not an effective separation of duties measure since it does not address the need for an independent verification of the code changes. Option B where the implementation team does not have access to change the source code, is not an effective separation of duties measure either since it does not address the need for an independent verification of the code changes.

A IS NOT ANSWER