CISA Exam Preparation | Reliable Evidence for Employee Access Deactivation

Most Reliable Evidence for Employee Access Deactivation

Prev Question Next Question

Question

Which of the following would provide the MOST reliable evidence to indicate whether employee access has been deactivated in a timely manner following termination?

Answers

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

D.

Out of the given options, the most reliable evidence to indicate whether employee access has been deactivated in a timely manner following termination is option D, which involves comparing termination forms with system transaction log entries.

Option A, comparing termination forms with dates in the HR system, could provide some evidence, but it may not be completely reliable. For example, there may be delays in HR updating the system, or an employee's termination may not be processed immediately.

Option B, reviewing hardware return-of-asset forms, may be useful in determining whether an employee has returned company assets, but it may not provide reliable evidence of whether their access has been deactivated. For example, an employee may return their laptop but still have access to the company's systems through a mobile device or personal computer.

Option C, interviewing supervisors to verify employee data is being updated immediately, may provide some insights, but it relies on the assumption that supervisors are always aware of when an employee is terminated and that they immediately update the employee's data in the system. This may not always be the case, and some supervisors may not have the necessary access or authority to update the system.

Option D, comparing termination forms with system transaction log entries, is the most reliable option because it provides direct evidence of whether access has been deactivated. If a terminated employee's access is still active, their login attempts or system activity would be captured in the transaction log entries. Comparing these entries with the termination forms can help identify whether access was deactivated in a timely manner following termination.

In conclusion, out of the given options, option D, comparing termination forms with system transaction log entries, would provide the most reliable evidence to indicate whether employee access has been deactivated in a timely manner following termination.