Greatest Access Control Concern in Accounts Payable Module

Segregation of Duties & Access Management

Answer Correct answer: B — Granting accounts payable staff the ability to update vendor bank account details directly violates segregation of duties and enables uncontrolled fund diversion.

Which of the following observations should be of GREATEST concern to an IS auditor assessing access controls for the accounts payable module of a finance system?

Payment files are stored on a shared drive in a writable format prior to processing.
Accounts payable staff have access to update vendor bank account details. Correct Answer
The IS auditor was granted access to create purchase orders.
Configured delegation limits do not align to the organization's delegations policy.

segregation of duties cisa accounts payable access control vendor master data fraud risk cisa audit finding prioritization

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests prioritization of access control risks, where candidates often overlook direct fraud vectors like vendor master data manipulation in favor of broader configuration issues.

This CISA question tests segregation of duties within financial applications. The analysis confirms that allowing AP staff to modify vendor banking details poses the highest fraud risk.

Option A is frequently chosen because writable shared drives violate data integrity best practices, but it lacks the immediate, high-impact fraud potential of unauthorized vendor bank detail changes.

Community Discussion (4 comments)

46080f2 👍 1 Selected: B

justification after reading the CISA Review Manual: It emphasizes that updating vendor bank details should be segregated from payment processing to prevent fraud (e.g., unauthorized changes to divert payments). If accounts payable staff can modify vendor banking information, it creates a risk of collusion or fraudulent transactions without detection. Privilege Creep and Authorization: The manual highlights the importance of enforcing the Principle of Least Privilege (POLP). Granting unnecessary access to sensitive functions (e.g., vendor bank details) violates POLP and increases the attack surface. Risk of Fraud: Uncontrolled access to vendor banking details directly enables financial misappropriation. The manual states that compensating controls are critical when SoD cannot be fully enforced, but such access without oversight is a severe control gap

pLulu 👍 1

B. Accounts payable staff have access to update vendor bank account details. This is because allowing accounts payable staff to update vendor bank account details poses a significant risk of fraud or error. It can lead to unauthorized changes, which might result in payments being diverted to incorrect or fraudulent accounts. This risk is higher compared to the other options, which, while concerning, do not pose as direct a threat to financial integrity and security.

Enig 👍 1

A. Payment files are stored on a shared drive in a writable format prior to processing. It means that i can possibly modify the file before finance processing. B is required for finance operation.

blehbleh 👍 1 Selected: B

This is B. We are talking about access controls. B is the only one that is referencing access controls for the accounts payable staff to modify the vendor account details.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option B represents the greatest concern because it directly violates the segregation of duties principle fundamental to financial application controls. When accounts payable personnel can both process payments and modify vendor banking information, they can easily create fictitious vendors and redirect company funds without detection. This combination of privileges eliminates independent verification and creates an immediate, high-impact fraud vector that auditors must prioritize above other configuration issues.

Why the Other Options Are Wrong

Option A describes writable payment files on a shared drive, which introduces data integrity risks but typically lacks the direct financial diversion capability of master data manipulation. Option C involves auditor access to create purchase orders, which threatens audit independence but does not compromise the operational security of the finance module itself. Option D highlights a mismatch between delegation limits and policy, representing a governance gap that requires remediation but poses a lower immediate threat than unchecked payment routing authority.

Community Comment Notes

Learners consistently emphasize that updating vendor bank details bypasses the critical separation between payment execution and master data maintenance. pLulu noted that this setup "poses a significant risk of fraud or error" by enabling unauthorized account changes that divert funds. Another participant correctly pointed out that while writable shared drives allow pre-processing modification, the direct access to alter banking information carries a much higher consequence for organizational assets. Finally, blehbleh highlighted that option B is the only choice explicitly referencing access controls for AP staff to modify vendor records.

Exam Strategy

When evaluating access control findings, prioritize scenarios that enable direct financial loss or fraud over general compliance gaps. Always apply the segregation of duties principle to identify conflicting roles within transactional workflows.

Frequently Asked Questions

Why is option A less concerning than B?

Writable shared drives risk file tampering, but they lack the direct, high-impact fraud vector of unauthorized vendor bank updates that bypass segregation of duties.

Does auditor access to create POs violate independence?

Yes, but it affects audit objectivity rather than the AP module's operational access controls. The question specifically targets finance system risks.

Related Analysis

Practice All CISA Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISA Practice Test →

← Back to CISA Study Guide