CompTIA CASP+ Practice Test

What does the separation of duties policy imply regarding system audits?

1. One person should handle all audit activities.

2. The systems administrator should not be present during audits.

3. Audits should focus solely on financial data.

4. Audits should be conducted annually.

The correct answer is: The systems administrator should not be present during audits.

The separation of duties policy is a critical internal control designed to reduce the risk of fraud and errors by dividing responsibilities among different individuals. In the context of system audits, this policy implies that certain key activities should not be performed by the same individual. Therefore, it is vital for the systems administrator to be absent during audits to ensure objectivity and independence in the process. By not being present, the systems administrator cannot influence the audit outcome or obscure information that could affect the audit's integrity. This measure helps maintain the integrity of the findings and supports accurate and unbiased auditing practices. The other options miss the key element of separation of duties. The first option suggests having a single person handle all audit activities, which directly contradicts the intent of the separation of duties policy. The third option, focusing solely on financial data, limits the scope of audits and does not align with the broader goals of comprehensive auditing. The last option regarding the frequency of audits does not address the fundamental principle of maintaining independence and objectivity in the audit process.