Exam CISA topic 1 question 104 discussion

The correct answer is C because there is no dual control due to system limitation, the only compensating control here is to reconcile each transaction with the invoice inorder to ensure the accuracy of the transaction processed.

When Segregation of Duties (SoD) cannot be enforced due to system limitations, the IS auditor must recommend a compensating control that reduces the risk of unauthorized or fraudulent payments. Written authorization for all payment transactions provides a formal approval process that adds a layer of oversight, helping to: Prevent unauthorized payments, Provide audit trails, and Ensure accountability. This control directly addresses the risk arising from the lack of SoD. Why not the others? B. Review payment transaction history ➤ This is a detective control and usually performed after transactions, which is less effective than preventive controls. C. Reconcile payment transactions with invoices ➤ Important but also detective in nature; it doesn’t prevent unauthorized payments upfront. D. Restrict payment authorization to senior staff members ➤ Restricting authorization is good but without a formal written approval process, it may lack accountability and evidence.

In system environments where SoD is not possible, Independent and periodic review of payment history is the most realistic and effective compensation control. This is useful for detecting user abuse and curbing the occurrence of fraud.

When segregation of duties can't be enforced, the best compensating control is implementing robust and regular reconciliations (option C) to independently verify the accuracy, validity, and authorization of accounts payable transactions.

Reconciliation is typically a post-transaction control and might not catch fraud or errors in the payment process before the transaction is authorized. Hence the answer is A.

I go with A. It says there is a system limitation, meaning they will have to use what they already have. Can't assign more work or responsibility since they got no people. Hence, best option is to create a authorization system in between.

Why not A?

Answer: C

A is preventive and compensating control

B>????????

answer should be D because it will have the dual control