Examkin

Question

Difficulty: MediumRegulatory Compliance and Legal Requirements Management

A publicly traded enterprise is undergoing an annual IT compliance review. The audit team discovers that application developers who manage the accounting database also hold administrative permissions to modify audit logs and approve change tickets for financial reporting software. Which regulatory requirement is directly compromised by this access control configuration, and what control must be enforced to achieve compliance?

  1. Sarbanes-Oxley Act (SOX); enforce segregation of duties by revoking financial log modification and approval permissions from developers.Answer
  2. B
    Gramm-Leach-Bliley Act (GLBA); implement multi-factor authentication and data-at-rest encryption for all customer financial transaction data.
  3. C
    Payment Card Industry Data Security Standard (PCI-DSS); establish network microsegmentation to isolate the database into a separate Cardholder Data Environment.
  4. D
    Health Insurance Portability and Accountability Act (HIPAA); execute a Business Associate Agreement (BAA) with the software developers.

Answer

Sarbanes-Oxley Act (SOX); enforce segregation of duties by revoking financial log modification and approval permissions from developers.
The correct answer identifies the Sarbanes-Oxley Act (SOX), which regulates internal controls over financial reporting for publicly traded entities. A core requirement of SOX Section 404 is maintaining segregation of duties so that individuals who create or manage software cannot unilaterally alter audit logs or approve financial transactions.

Step-by-Step Solution

1
Identify the data scope and regulatory context.
The scenario concerns internal accounting software, financial reporting, and audit logs for a publicly traded company.
Publicly traded corporations in the US are subject to Sarbanes-Oxley Act (SOX) compliance regarding internal controls over financial reporting.
2
Analyze the compliance deficiency in the scenario.
Developers possess administrative access to financial audit logs and approval rights for financial code changes.
Allowing developers to modify financial audit logs violates segregation of duties principles mandatory under SOX Section 404.
3
Select the appropriate regulatory governance framework and corrective control.
Enforce SOX compliance by separating software development duties from audit log management and financial approval functions.
Proper segregation of duties ensures no single individual can fabricate or falsify financial reports without independent detection.

Key Concept

Sarbanes-Oxley Act (SOX) Internal Controls & Segregation of Duties
Rate this question

Topics

Regulatory Compliance and Legal Requirements Management

More questions from this topic