ERP ERP Security, Access Control & Role-Based Permissions 3

Question 1

What is the primary purpose of an ERP system audit trail?

Accepted Answer

To provide a chronological record of user actions for accountability and investigation

Answer

Audit trails record who did what and when in the system, enabling accountability, forensic investigation, and verification of compliance with internal controls.

Question 2

Which US regulation most directly impacts access control and audit trail requirements in ERP systems used by publicly traded companies?

Accepted Answer

SOX (Sarbanes-Oxley Act)

Answer

SOX requires publicly traded companies to maintain internal controls over financial reporting, which directly mandates ERP access controls, SoD enforcement, and audit trails.

Question 3

In ERP security governance, what does the acronym 'GRC' stand for?

Accepted Answer

Governance, Risk, and Compliance

Answer

GRC (Governance, Risk, and Compliance) in ERP context refers to integrated tools and processes for managing organizational policies, risk assessment, and regulatory compliance requirements.

Question 4

What is a 'User Access Review' (UAR) in ERP governance?

Accepted Answer

A periodic process where managers certify that their employees' access rights remain appropriate

Answer

A UAR is a formal governance process where business managers review and certify that each employee's system access remains appropriate and necessary for their current role.

Question 5

What is a 'compensating control' in the context of an ERP SoD conflict?

Accepted Answer

An alternative control that mitigates risk when an SoD conflict cannot be immediately eliminated

Answer

Compensating controls are alternative mitigations such as enhanced monitoring or mandatory managerial approval applied when ideal SoD separation is not immediately achievable.

(ERP) Enterprise Resource Planning Certified Practice Test

(ERP) Enterprise Resource Planning Certified Practice Test

ERP ERP Security, Access Control & Role-Based Permissions 3