Which of the following is a not a preventative control?

Which of the following is a not a preventative control?
A .  Deny programmer access to production data.
B .  Require change requests to include information about dates, descriptions, cost analysis and anticipated effects.
C .  Run a source comparison program between control and current source periodically.
D .  Establish procedures for emergency changes.

View Answer

Answer: C

Explanation: Running the source comparison program between control and current source periodically allows detection, not prevention, of unauthorized changes in the production environment. Other options are preventive controls. Source: Information Systems Audit and Control Association, Certified Information Systems Auditor 2002 review manual, chapter 6: Business Application System Development, Acquisition, Implementation and Maintenance (page 309).