Question

During a review of identity and access management, an IS auditor discovers that several active user accounts belong to employees who left the organization more than six months ago. HR performs timely terminations in its own system, but these accounts still have access to a critical financial application. Which control weakness is MOST likely the root cause?

Accepted Answer

There is no automated deprovisioning link or periodic access recertification between HR and the application

Answer

The application does not enforce a strong password complexity policy

Answer

Multi-factor authentication has not been enabled for the financial application

Answer

The application audit log retention period is too short to detect misuse