A quarterly user access review stopped being performed after the employee who ran it left the company, and nobody noticed for three quarters. Which measure would BEST prevent this from happening again?
Select an answer to reveal the explanation.
Short Explanation
If you tie a job to a person, it walks out the door with them. Tie it to a role and hand it over whenever someone leaves or moves. The trap is better documentation, which helps whoever picks it up but doesn't make sure anyone actually does.
Full Explanation
Controls fail silently when their ownership depends on an individual. Assigning each control to a role, recorded in the control inventory, and making the reassignment of control responsibilities a required step in leaver and transfer procedures ensures that someone is always accountable when people change. Combined with monitoring of control performance, this would have revealed the gap within one cycle rather than three. Requiring the departing employee's manager to perform all of their controls personally is a temporary patch that overloads the manager, may conflict with segregation of duties and does not establish durable ownership. Better documentation makes the review easier to perform, which is useful, but a detailed procedure with no assigned performer still is not executed; the failure here was ownership, not clarity. Reducing the review to annual lowers the control's effectiveness to make it easier to sustain, accepting more risk without addressing the root cause and without a risk owner's decision. Exam caveat: control ownership should also be reviewed as part of periodic control testing and reporting so that missing evidence is detected promptly. Operational check: confirm the control inventory lists a role-based owner for every control and that the leaver checklist includes reassignment of control responsibilities.