An internal auditor is reviewing physical and environmental controls for an IT organization. Which control activity should not be part of this review?
A) Develop and test the organization's disaster recovery plan.
B) Install and test fire detection and suppression equipment.
C) Restrict access to tangible IT resources.
D) Ensure that at least one developer has access to both systems and operations.

Question

Quizplus · Accepted Answer

Ensuring that at least one developer has access to both systems and operations is not a physical or environmental control. It relates more to access control and segregation of duties, which are not the focus of physical and environmental controls.

An Internal Auditor Is Reviewing Physical and Environmental Controls for an IT