Exam CRISC topic 1 question 1705 discussion

Overriding segregation of duties (SoD) controls poses the greatest risk in the SDLC because it: Introduces the potential for unauthorized changes, fraud, errors, or malicious activities. Undermines fundamental controls meant to ensure the integrity and reliability of the system. Can significantly compromise security, auditability, and compliance throughout the development lifecycle. Why not the other options? B. Testing by IT support users without end-user input: A concern for functionality or usability, but less severe than overriding critical security controls. C. Data anonymization used during end-user testing: Actually reduces risk by protecting sensitive data. D. User testing as the final phase: A standard approach in many SDLC methodologies; not inherently a significant risk.

Segregation of duties controls are overridden during user testing phases: This is the most concerning issue for a risk practitioner because segregation of duties (SoD) is a critical internal control designed to prevent conflicts of interest and reduce the risk of errors and fraud. Overriding these controls during any phase of the SDLC, including user testing, can lead to significant risks such as unauthorized access, manipulation of data, and lack of accountability. This concern directly impacts the integrity, security, and reliability of the system being developed.

A. Segregation of duties controls are overridden during user testing phases Segregation of duties controls are critical for preventing fraud and errors by ensuring that no single individual has the ability to execute a critical process from beginning to end without oversight. Overriding these controls during user testing phases could potentially lead to unauthorized or inappropriate actions being taken, increasing the risk of fraud, errors, or data breaches. Therefore, a risk practitioner would be particularly concerned if segregation of duties controls were compromised during any phase of the SDLC, as it could introduce significant risks to the development process and the resulting system