ISACA Certified Information Systems Auditor Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  The MOST effective compensating control is A. Rotation of log monitoring and analysis responsibilities. In a small startup where SoD cannot be fully implemented, rotating log-monitoring duties creates a peer/independent review without requiring additional staff. The CISA CRM identifies supervisory reviews and independent reviews as compensating controls, whereas management review is primarily a governance/oversight function, not necessarily an operational or independent review. Therefore, A is the best fit.

• Chose B1

  Answer B is correct. When SOD is not possible think of a compensating control first (UAR or other management reviews).

• 1

  b for bravo