CISA Question 189

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  D. Comparing updates against authorization This approach offers the most robust control over vendor master file updates. By requiring authorization before changes are implemented, it helps prevent unauthorized modifications and ensures proper oversight. This is a key aspect of maintaining data integrity and reducing the risk of errors or fraud. While pre-numbered forms (Option A) provide a valuable paper trail, they don't guarantee authorized changes on their own. The authorization process (Option D) acts as a stronger safeguard.

• Chose A3

  A is a preventive control, whilst D is detective. It is important to have a detective control, however not without pre-approval process. Don't agree with that.

• Chose D1

  While periodically reviewing the entire vendor master file (option C) is important for detecting discrepancies or errors, comparing updates against authorization (option D) provides a more proactive approach to control. By ensuring that any changes made to the vendor master file are authorized beforehand, organizations can mitigate the risk of unauthorized or fraudulent updates, thereby maintaining the integrity and accuracy of the vendor information. This approach adds an extra layer of security and validation to the update process, helping to prevent potential issues before they occur.