An internal auditor is reviewing a new automated human resources system. The system contains a table of pay rates which are matched to the employee job classifications. The best control to ensure that the table is updated correctly for only valid pay changes would be to:
The best control to ensure the table of pay rates is updated correctly for only valid pay changes would be to require a supervisor in the department, who does not have the ability to change the table, to compare the changes to a signed management authorization. This leverages the principle of segregation of duties, ensuring that the person verifying the updates cannot make unauthorized changes themselves. This approach provides a robust control by combining a manual supervisory check with proper authorization, reducing the risk of errors or fraud.
segregation of duty, this guy who has no access to the table, he will check and confirm if the number are matched
There should be always someone to supervise, things like (insert, update, delete in tables)are being done by machine only, but someone should check if its done correctly
C will not prevent unauthorised changes as this control only checks reasonableness (e.g. format, etc.)
I think the answer should be C instead of B as Automated Controls are more reliable than Manual Controls
Option B is the next best
Can anyone explain why C is incorrect?
There is a check of the updated data, not only the updating operation.
But why not C?