CISA Certified Information Systems Auditor – Question2667

Due to the small size of the payroll department, an organization is unable to segregate the employee setup and payroll processing functions. Which of the following would be the BEST compensating control for the lack of segregation of duties?

A.
An independent payroll disbursement review is conducted.
B. The system is configured to require secondary approval for changes to the employee master file.
C. A review is conducted to verify that terminated employees are removed from the employee master file.
D. A payroll variance report is reviewed for anomalies every pay period.

Correct Answer: D