What type of evidence is best for supporting current system configuration settings?

What type of evidence is best for supporting current system configuration settings?

• A. System configuration values imported to a spreadsheet by the system administrator
• B. Standard report with configuration values retrieved from the system by the IS auditor
• C. Dated screenshot of the system configuration settings
• D. Annual review of approved system configuration values by the business owner

Answer: (B)

The most effective type of evidence for supporting current system configuration settings is a standard report with configuration values retrieved from the system by the IS auditor. This choice is ideal because it provides an objective, independent verification of the current system settings directly from the source. The auditor’s access to the system allows for a comprehensive review, ensuring that the values reported are accurate and reflect the real-time state of the configurations. When drawn directly from the system, this evidence minimizes the risk of human error or manipulation that could occur with self-reported data. Additionally, IS auditors can ensure the integrity of the data by applying standardized procedures and controls during the reporting process, enhancing the reliability and trustworthiness of the evidence. This option also allows for a thorough evaluation of configuration settings against established benchmarks or security standards, making it a more robust choice for demonstrating compliance and effectiveness in maintaining system security and operational integrity. The other options may lack the same level of validation, reliance, or current applicability when it comes to assessing configuration management within the system.

The most effective type of evidence for supporting current system configuration settings is a standard report with configuration values retrieved from the system by the IS auditor. This choice is ideal because it provides an objective, independent verification of the current system settings directly from the source. The auditor’s access to the system allows for a comprehensive review, ensuring that the values reported are accurate and reflect the real-time state of the configurations.

When drawn directly from the system, this evidence minimizes the risk of human error or manipulation that could occur with self-reported data. Additionally, IS auditors can ensure the integrity of the data by applying standardized procedures and controls during the reporting process, enhancing the reliability and trustworthiness of the evidence.

This option also allows for a thorough evaluation of configuration settings against established benchmarks or security standards, making it a more robust choice for demonstrating compliance and effectiveness in maintaining system security and operational integrity. The other options may lack the same level of validation, reliance, or current applicability when it comes to assessing configuration management within the system.