Exam CISA topic 1 question 389 discussion

Segregation of duties is a fundamental principle of internal controls aimed at preventing errors and fraud by dividing responsibilities among different individuals or roles. By restricting program functionality according to user security profiles, the organization can control access to specific functions or actions within the accounts payable system based on the roles and responsibilities of individual users. This ensures that users only have access to the functionalities necessary for their job roles, preventing unauthorized or inappropriate access to sensitive functions and data.

Answer: C Option D, restricting program functionality according to user security profiles, contributes to access control and limits users' abilities based on their roles. However, it does not ensure strict segregation of duties within the accounts payable department. While it helps prevent unauthorized access to certain functions, it doesn't inherently prevent a single user from having conflicting duties, such as being able to both create and approve payments. Restricting access to update programs specifically to accounts payable staff ensures a clearer segregation of duties by limiting who can perform specific tasks within the department.

C. Restricting access to update programs to accounts payable staff only This control limits the access to update programs to only those staff members who are responsible for accounts payable activities. By restricting access in this manner, the organization can prevent unauthorized personnel from making changes to transaction records, thereby ensuring that the segregation of duties principle is maintained. Other staff members, such as those responsible for creating transaction records or reviewing/approving payments, would have different access privileges tailored to their respective roles, further enforcing segregation of duties.

`d' is answer

D. Rokeby based

D is correct.. A is incorrect bcos just mentioning the user name against the transaction, might hold that person responsible/accoutable but will not stop an unrelated employee from making changes. will not solve. SOD primarily required that the jobs are performed by appropriate / relevant individuals.