Question

During quarterly control monitoring, a risk analyst notices that the same access-provisioning control has generated approved exceptions in each of the last four quarters, always for the same business unit citing 'urgent operational need.' Each exception was individually approved within policy and expired on schedule. What should the analyst do FIRST?

Accepted Answer

Escalate the recurring exception pattern for analysis, as it may indicate the control is not aligned with legitimate business needs

Answer

Continue approving future exceptions since each has followed the established policy and expired on time

Answer

Immediately recommend removing the access-provisioning control because it is repeatedly bypassed

Answer

Report the business unit to internal audit for chronic non-compliance with the control