Question

During an audit of a data center's physical access controls, an IS auditor observes badge-reader operation for one hour on the day of the visit and notes that all entries required a valid badge. The auditor plans to conclude that access controls operated effectively throughout the entire audit period. What is the MOST significant limitation of relying on this observation as audit evidence?

Accepted Answer

The observation reflects only a point in time and may not represent control operation across the whole period

Answer

Observation evidence is inadmissible unless corroborated by management interviews

Answer

Physical controls cannot be evaluated without penetration testing

Answer

Observation is less reliable than management's verbal assertions about the controls