Current Attempt in Progress

To obtain evidence that user identification and password controls are functioning as designed, an auditor would most likely

Extract a random sample of processed transactions and ensure that transactions are appropriately authorized.

Examine a sample of assigned passwords and access authority to determine whether password holders have access

authority incompatible with their other responsibilities.

Review the online transaction log to ascertain whether employees using passwords have access to data files and computer

programs.

Observe the file librarian's activities to discover whether other systems personnel are permitted to operate computer

equipment without restriction.