A security administrator who grants and modifies user privileges is also the person who reviews the logs of privilege changes each week. What is the BEST corrective action?

Segregation of duties prevents a single individual from both performing a sensitive activity and verifying that it was performed correctly. When the administrator who grants privileges also reviews the logs of those changes, an error or deliberate misuse can go undetected because the person best positioned to conceal it is the one checking. The corrective action is to assign the review to someone independent of privilege administration, such as a security monitoring function or the relevant system owner, so that changes are verified by a different party. Increasing log retention helps later investigation but does not create an independent check; the conflicted review continues in the meantime. An annual attestation from the administrator relies on self-reporting by the very person whose actions need verification and adds no independence. Automating provisioning so every action is logged improves the completeness of the record, but if the same administrator still reviews it, the conflict remains. Exam caveat: in small organizations where full segregation is impractical, compensating controls such as management review of change reports are acceptable, but they must still involve someone independent. Operational check: confirm the review is performed by a named independent reviewer, evidenced weekly, and that exceptions are escalated to the system owner.