The correct answer is D. Review an automated report of user privileges.
The most efficient way to identify separation of duties violations in a system is to review an automated report showing assigned user privileges, roles, and access combinations. This allows the auditor to quickly compare user access against a segregation-of-duties matrix and identify conflicting permissions.
Option A may help the auditor understand business processes, but it does not efficiently identify actual access conflicts in the system. Option B is not enough because recent violations only show known or detected issues; they may miss existing toxic combinations. Option C may help gather context, but interviews are less efficient and less reliable than automated access reports.
ISACA defines segregation/separation of duties as a core internal control that assigns responsibilities so one person is not in a position to both commit and conceal errors or irregularities. Automated privilege reporting is the most efficient evidence source for identifying this type of access conflict.
References: ISACA CISA Exam Content Outline, Domain 5; ISACA Interactive Glossary, "Segregation
/separation of duties."