During a review of system access, an IS auditor notes that an employee who has recently changed roles within the organization still has previous access rights.
The auditor's NEXT step should be to:
Click on the arrows to vote for the correct answer
A. B. C. D.A.
In this scenario, the IS auditor has identified an access control issue where an employee still retains previous access rights despite having changed roles within the organization. This indicates that the access control mechanisms in place are not functioning effectively, and there is a risk of unauthorized access to sensitive information or systems.
The NEXT step for the IS auditor should be to recommend remedial action to address the identified access control issue. The best course of action would depend on the organization's policies, procedures, and the context of the situation. However, based on the options provided in the question, the most appropriate action would be to select option A, "determine the reason why access rights have not been revoked."
Option A is the best choice because it involves investigating the root cause of the problem. The IS auditor should identify why the access rights have not been revoked, such as if there was a miscommunication or delay in updating access rights following the employee's change in roles. This step will help the auditor understand the underlying issue and provide appropriate recommendations to mitigate the access control risk effectively.
Options B, C, and D are not the best choices because they do not address the root cause of the problem. Recommending a control to automatically update access rights (option B) may help prevent similar issues in the future, but it does not address the current situation. Directing management to revoke current access rights (option C) may be necessary, but without understanding the reason for the access rights not being revoked, this action may be premature or ineffective. Finally, determining if access rights are in violation of software licenses (option D) is not relevant to the current situation and does not address the identified access control issue.