Database administrators (DBAs) have privileged access, meaning they can make unauthorized or hidden changes to data, database structures, and security settings without detection. This presents a high risk of fraud, data manipulation, and security breaches.
* A. The risk that database administrators will disagree with temporarily preventing user access to the database for auditing purposes. (Incorrect)
* While resistance from DBAs during an audit can be a challenge, it is not a significant risk compared to the ability to manipulate data unnoticed.
* B. The risk that database administrators do not receive new patches from vendors that support database software in a timely fashion. (Incorrect)
* Patch management is a security concern but does not directly relate to the unique risk of DBAs abusing privileged access.
* C. The risk that database administrators set up personalized accounts for themselves, making the audit time-consuming. (Incorrect)
* While personal accounts can complicate audits, the greater risk is that DBAs can make changes without detection.
* IIA GTAG 4 - Management of IT Auditing emphasizes the need for controls over privileged access to prevent unauthorized database modifications.
* IIA Standard 2110 - Governance requires internal auditors to assess risks related to IT governance and privileged access management.
* IIA GTAG 8 - Auditing Application Controls highlights that auditors must review DBA activity logs and ensure segregation of duties.
Explanation of Answer Choices:IIA References:Thus, the correct answer is D. The risk that database administrators could make hidden changes using privileged access.