The best way to determine whether programmers have permission to alter production data is to review the access rights that have been granted. In audit terms, the question is asking whether the programmers are authorized to perform a specific action in production. The most direct evidence of that authorization is the actual privileges assigned to their accounts or roles. ISACA access-control guidance consistently focuses on granted access, segregation of duties, and restricting direct production or database access.
Option A is correct because granted rights directly show whether programmers can update, modify, or otherwise alter production data. If those privileges are present, the permission exists; if not, it does not. This is more direct than reviewing configuration or implementation history.
Option B is not the best answer because reviewing how recent changes were implemented may indicate whether developers were involved in production changes, but it does not directly confirm whether they currently have permission to alter production data. It is indirect evidence.
Option C is also weaker than A. Access control system configuration may reveal how permissions are structured, but the clearest evidence is still the actual rights granted to the programmers or their roles.
Option D is incorrect because log settings show what may be recorded, not what access is authorized. Logs may help detect misuse, but they do not define whether permission exists.
Therefore, A is the best answer because reviewing granted access rights is the most direct and reliable way to determine whether programmers can alter production data.
References (Official ISACA):
* ISACA Journal, An Approach Toward Sarbanes-Oxley ITGC Risk Assessment - logical access and direct database access are central audit concerns.
* ISACA Journal, Auditing Amazon Web Services - audit focus includes how access is restricted and how administrative activity is segregated.
* ISACA, Selected COBIT 5 Processes for Essential Enterprise Security - access should be justified, authorized, logged, and monitored.