Frequent security reviews of the audit log (C) most directly assure the integrity of an accounting system by enabling detection of unauthorized or inappropriate transactions and configuration changes. Integrity focuses on accuracy, completeness, and protection from unauthorized modification, and audit logs provide evidence of system activity that can be reviewed for anomalies, fraud, or policy violations. Awareness training (A) is preventive but indirect. Two-factor authentication (B) strengthens access control, but does not detect improper changes made by authorized users. Annual audits (D) are periodic and retrospective, making them less effective for ongoing integrity assurance. CISM emphasizes that detective controls, such as log monitoring and review, are critical for high-integrity systems like financial and accounting applications where timely detection is essential.
References: ISACA CISM Review Manual (Program management-control types, monitoring, integrity assurance); CISM Exam Content Outline (Domain 3).