Audit Objectives Relating to Access Privileges
The auditor’s objective is to verify that access privileges are granted in a manner that is consistent with that need to separate incompatible functions and is in accordance with the Should verify that individuals are granted access to data and programs based on their need to know.
- Review personnel records to determine whether privileged employees undergo an adequately intensive security clearance check in compliance with company policy.
- Review employee records to determine whether users have formally acknowledged their responsibility to maintain the confidentiality of company data.
- Review the user’s permitted log-on times. Permission should be commensurate with the tasks being performed.
Password Control
A password is a secret code the user enters to gain access to systems, applications, data file, or a network server. If the user cannot provide the correct password, the operating system should deny access. Although passwords can provide a degree of security, when imposed on nonsecurityminded users, password procedures can result in end-user behavior that actually circumvents security. The most common forms of contrasecurity behavior include: