Section: Protection of Information Assets
Explanation:
When a business application is developed, the best practice is to assign an information or data owner to
the application. The Information owner should be responsible for authorizing access to the application itself
or to back-end databases for queries. Choices B and C are not correct because the security administrator
and manager normally do not have responsibility for authorizing access to business applications. The
requestor's immediate supervisor may share the responsibility for approving user access to a business
application system; however, the final responsibility should go to the information owner.

Explanation/Reference:
Explanation:
The IS department should specifically consider the manner in which resources are allocated in the short term. Investments in IT need to be aligned with top management strategies, rather than focusing on technology for technology's sake. Conducting control self-assessments and evaluating hardware needs are not as critical as allocating resources during short-term planning for the IS department.

Section: Protection of Information Assets
Explanation:
It is good practice when finding a potential exposure to look for the best controls. Though granting the
database administrator (DBA) access to production data might be a common practice, the IS auditor should
evaluate the relevant controls. The DBA should have access based on a need-to- know and need-to-do
basis; therefore, revocation may remove the access required. The DBA, typically, may need to have access
to some production data. Granting user authorizations is the responsibility of the data owner and not the
DBA.