Awalk-through of job functionsprovides direct evidence thatseparation of duties (SoD)is implemented effectively. It involves observing employees as they perform tasks to confirm that no single person has excessive privileges.
Walk-through of Job Functions (Correct Answer - D)
Confirms that duties are appropriately divided in real-world operations.
Helps verify whether security policies and controls are enforced.
Example:An auditor observes that the same person cannot create and approve financial transactions.
Review of Personnel Files (Incorrect - A)
Personnel files contain job details but do not confirm how duties are performed.
Analysis of Documented Job Descriptions (Incorrect - B)
Job descriptions may be outdated or inaccurate.
Review of Organizational Chart (Incorrect - C)
Shows reporting relationships but does not confirm SoD implementation.
References:
ISACA CISA Review Manual
COBIT 2019: Risk Management and Governance
ISO 27001: Segregation of Duties Control