For the question below,

Choose right answer;

Explain why the response selected is correct;

Explain why the alternate response is incorrect.

In which of the following situations is the auditor most likely to assess control risk at less than high?

A. There are not enough people to achieve adequate segregation of duties within IT department and between the IT department and the user department.

B. Backup and recovery procedures are fully documented.