mediumMultiple Choice
User Access Recertification: Most Significant Finding
An IS auditor is auditing the user access management process for a large healthcare organization that uses an electronic health records (EHR) system. The organization has 5,000 users including doctors, nurses, and administrative staff. The auditor reviews a sample of access requests and finds that 20% of the requests were approved by the user's manager but the approval was not documented in the system. The auditor also finds that there is no periodic review of user access rights. The IT security manager states that users are automatically provisioned based on their role in the HR system, and that access reviews are performed manually by managers but not documented. What is the auditor's BEST recommendation to address the most significant risk?
Quick Answer
The correct answer is to implement an automated access recertification process with quarterly reviews. This directly addresses the most significant finding—the absence of any periodic review of user access rights—which is a systemic control failure that can allow excessive or inappropriate access to protected health information, such as a former nurse retaining EHR access. On the CISA exam, this scenario tests your ability to prioritize compensating controls over procedural weaknesses; the undocumented approvals are a secondary issue, while the lack of a review cycle represents a critical gap in user access recertification and compensating controls. A common trap is focusing on the approval documentation problem, but the auditor must address the root cause—no recurring validation of entitlements against current roles. Memory tip: think “No review, no trust”—automated recertification enforces documented, regular checks that manual processes often skip.
⚠ Common exam trap
The trap here is that candidates focus on the documented approval finding (20% undocumented) and choose Option C, missing that the lack of any periodic review is a far more systemic risk that automated recertification directly mitigates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement an automated access recertification process with quarterly reviews.
The most significant risk is the lack of periodic review of user access rights, which can lead to excessive or inappropriate access (e.g., a former nurse retaining EHR access). Automating access recertification with quarterly reviews directly addresses this by enforcing a regular, documented validation of user entitlements against their current roles, reducing the risk of unauthorized access to protected health information (PHI) under HIPAA. While the undocumented approvals are a control weakness, the absence of any review cycle is a systemic failure that automated recertification resolves.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement an automated access recertification process with quarterly reviews.
Why this is correct
Automated recertification directly addresses the missing periodic review, forcing documented, scheduled attestation of every user's entitlements. Quarterly cycles satisfy the stem's control gap by generating auditable evidence that managers validated access, replacing the undocumented manual practise. This closes the segregation-of-duties and least-privilege risk inherent to 5,000 EHR users.
- ✗
Disable automatic provisioning and require manual approval for all access.
Why it's wrong here
Removing automatic role-based provisioning would not address the undocumented approvals or missing periodic reviews, and would weaken control by adding manual error. It is tempting because manual approval sounds rigorous, and would suit environments where no authoritative HR source exists to drive provisioning.
- ✗
Require that all access approvals be documented and stored in the system.
Why it's wrong here
Documenting approvals addresses only the missing evidence, leaving the absent periodic review of access rights unaddressed, which is the greater risk for accumulated excessive privileges. It is tempting because approval documentation is a genuine control, and would be correct where approvals are the sole identified weakness.
- ✗
Perform a risk assessment to determine appropriate access controls.
Why it's wrong here
A risk assessment identifies and prioritises risks but implements no control, leaving the undocumented approvals and absent access reviews unchanged. It is tempting because risk assessment legitimately precedes control design, and would be correct as an early step before selecting specific access controls.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During an audit of a financial application, the IS auditor discovers that user access reviews are performed quarterly instead of monthly as required by policy. Which of the following is the BEST initial action for the auditor?
medium- A.Recommend that the policy be changed to allow quarterly reviews
- B.Report the noncompliance with the policy as a finding immediately
- C.Escalate the issue to senior management for immediate resolution
- ✓ D.Determine if compensating controls mitigate the risk of less frequent reviews
Why D: The IS auditor's primary role is to assess risk, not to enforce policy blindly. Quarterly reviews may still be acceptable if compensating controls (e.g., automated provisioning/deprovisioning, real-time monitoring, or role-based access controls) effectively reduce the risk of unauthorized access between reviews. Determining the presence and effectiveness of such controls is the best initial action before deciding whether to report noncompliance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.