Which of the following should a general internal auditor be able to characterize as an IT-related risk?

Which of the following should a general internal auditor be able to characterize as an IT-related risk?
A . Computer servers are in a room that is accessible to all employees,
B . An IT architect avoids taking vacations and sharing his workload with coworkers,
C . Hours billed by IT developers exceed 24 hours daily.
D . Audit logs are lacking in a system that processes personal data.

View Answer

Answer: D

Explanation:

Audit logs are crucial for monitoring and reviewing the activities within IT systems, especially those processing personal data. The lack of audit logs presents a significant IT-related risk as it undermines the ability to trace any unauthorized or inappropriate access and actions within the system, thereby impacting the integrity and security of data.

Reference: Best practices in IT security and internal control frameworks like COBIT and ISO/IEC 27001.