CISA Question 104

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  When Segregation of Duties (SoD) cannot be enforced due to system limitations, the IS auditor must recommend a compensating control that reduces the risk of unauthorized or fraudulent payments. Written authorization for all payment transactions provides a formal approval process that adds a layer of oversight, helping to: Prevent unauthorized payments, Provide audit trails, and Ensure accountability. This control directly addresses the risk arising from the lack of SoD. Why not the others? B. Review payment transaction history ➤ This is a detective control and usually performed after transactions, which is less effective than preventive controls. C. Reconcile payment transactions with invoices ➤ Important but also detective in nature; it doesn’t prevent unauthorized payments upfront. D. Restrict payment authorization to senior staff members ➤ Restricting authorization is good but without a formal written approval process, it may lack accountability and evidence.

• 1

  Bro it says compensating Not Prevent

• Chose B2

  In system environments where SoD is not possible, Independent and periodic review of payment history is the most realistic and effective compensation control. This is useful for detecting user abuse and curbing the occurrence of fraud.