External financial auditors for a county ask for evidence that IT controls affecting the CAFR reporting path are operating. What is the security team's best facilitation focus?
Select an answer to reveal the explanation.
Short Explanation
Outside auditors are not there for a full red-team tour — they need proof that IT controls touching the books actually ran. Map access reviews, changes, and batch jobs to the financially significant systems and give clean samples. Dumping unrelated exploit kits or scrubbing logs just slows everyone down.
Full Explanation
External financial audits examine IT controls that could affect the integrity of financial reporting. Facilitation means scoping evidence to financially significant applications and supporting ITGCs, then producing timely samples of access certifications, change documentation, and operations evidence. Unrelated offensive artifacts, evidence destruction, or substituting internal scanners for the external auditor's work undermines the engagement.