Thinking beyond this$$ problem, why should the IT staff not have custody of physical$$ assets? What IT functions need to be$$ segregated?

IT staff should not have custody of physical assets$$ because:$($Select the three that$$ apply.$)$

A$.$

Operations$($processing$)$ staff is changing the records

B$.$

Programming authorizes changes to records

C$.$

Data entry is an authorization function

D$.$

Data entry is a recording function$$

E$.$

IT staff may prioritize digital security over physical asset management.

What IT functions need to be$$ segregated? $($Select the three that$$ apply.$)$

A$.$

$$Programmers$/$developers should not also have operational access to the system because they could$$ "pause" programs, make unauthorized$$ changes, and then resume. They should not be$$ operators, system or network$$ administrators, or$$ "functional" users like anyone in payables. Nor should they be security$$ management, data base$$ administrators, or data control.$$

B$.$

Storage of data files and databases is an authorization$$ function, as data control is responsible for accessing company records. They must be segregated from the recording and custody functions. For$$ example, once programs are tested and$$ approved, programmers should have approval to access to live data.

C$.$

$$Creation$/$Deletion of user accounts and new business relationships should be separate from their authorization and activation. $$ Otherwise, an employee can create$$ account, use it to perform unauthorized$$ actions, and then delete the account.

D$.$

$$Creation$/$Deletion of user accounts and new business relationships should be done by the computer operators.$$ Otherwise, management can create an$$ account, use it to perform unauthorized$$ actions, and then delete the account.

E$.$

Storage of data files and databases is a custody$$ function, as data control is responsible for company records. They must be segregated from the recording and authorization functions. For$$ example, once programs are tested and$$ approved, programmers do not need any access to live data.