An information security manager must determine whether a quarterly user access review control operated effectively during the past year. What is the BEST evidence to examine?
Select an answer to reveal the explanation.
Short Explanation
If you want to know whether the gym membership got used, you look at the check-ins, not the brochure. Testing a quarterly review means seeing that each review happened and did something. The trap is a signed statement or a policy: they tell you what should happen, not what did.
Full Explanation
Testing operating effectiveness of a periodic control requires evidence that the control was performed on each occasion during the period and that it achieved its purpose. For a quarterly access review, that means the completed review records for every quarter in the year, showing who reviewed which accounts and when, together with evidence that access identified as inappropriate was actually removed or modified. Because there are only four occurrences, examining all of them is practical and gives a complete picture. The approved procedure documents how the review should be done and supports the design evaluation, but it does not show that any review took place. A written statement from the system owner is testimonial evidence from an interested party; it may be honest but cannot by itself demonstrate performance. A current user list shows the state of access today and might reveal problems, but it does not prove that reviews occurred each quarter or that findings were acted on at the time. Exam caveat: the strength of evidence generally increases when it is documentary, produced during the control's operation and obtained by the tester directly rather than through assertion. Operational check: for each quarter, match review sign-off dates to the schedule and trace a sample of removal decisions to the corresponding access changes.