In a small IT web development company where developers must have write access to production, the BEST recommendation of an IS auditor would be to:

The core issue is a lack of Segregation of Duties (SoD), as developers can modify the production environment. However, the question states that developers must have this access, treating it as a non-negotiable business constraint. The ideal preventive control (removing access to enforce SoD) is therefore not viable. In such situations, an IS auditor's best recommendation is to implement strong compensating controls. Continuous monitoring is a detective and corrective control that provides timely insight into activities within the production environment. It allows for the prompt detection and review of all changes, mitigating the risk of unauthorized or erroneous modifications that could arise from the lack of SoD.

A. hire another person to perform migration to production.

While this would establish proper SoD, it may not be a feasible or practical recommendation for a "small" company due to cost constraints.

C. remove production access from the developers.

This recommendation directly contradicts the business requirement explicitly stated in the scenario ("developers must have write access"), making it an impractical and ineffective suggestion.

D. perform a user access review for the development team.

A user access review is a periodic, detective control. It is insufficient for mitigating the continuous, high-level risk of developers making direct changes to production.

---

1. ISACA

CISA Review Manual

27th Edition.

Chapter 1

Section 1.3.3

Types of Controls: This section distinguishes between preventive

detective

and corrective controls. It notes that when preventive controls are not feasible

detective controls (such as monitoring and logging) are essential to "detect errors or irregularities that may have occurred." This supports using monitoring as a compensating control when SoD (a preventive control) cannot be enforced.

Chapter 3

Section 3.4.4

Change Management Process: This section emphasizes that "A key control is the separation of duties between development

testing and production." The scenario violates this key control

necessitating a compensating measure.

Chapter 4

Section 4.5.1

System Monitoring: This section states

"Monitoring provides a detective control to help ensure that systems are operating as intended... Key items to monitor include... unauthorized access attempts... and unauthorized changes to files or system settings." This directly supports option B as the appropriate response to the identified risk.

2. Gramling

A. A.

Rittenberg

L. E.

& Johnstone

K. M. (2012). Auditing. South-Western Cengage Learning.

In discussions on internal controls (often covered in Chapter 6)

auditing textbooks for reputable university programs emphasize that when a fundamental control like segregation of duties is absent

especially in smaller entities

auditors must look for effective compensating controls. These controls

such as detailed management review of activity logs or continuous monitoring

are designed to mitigate the risk introduced by the control deficiency. This academic principle validates recommending monitoring when SoD is not possible.