Periodic review of access profiles by management is an additional control that is required when using swipe cards to limit employee access to restricted areas. Swipe cards are a type of physical access control that use magnetic stripes or radio frequency identification (RFID) to store and transmit information about the cardholder's identity and access rights. Swipe cards can help to prevent unauthorized entry, protect sensitive assets and data, and monitor access activity. However, swipe cards alone are not enough to ensure effective access control. They need to be complemented by other controls, such as:
* Periodic review of access profiles by management: This is a type of logical access control that involves verifying that the access rights assigned to each cardholder are appropriate, necessary, and consistent with the organization's policies and procedures. Periodic review of access profiles can help to detect and correct any errors, inconsistencies, or violations in the access control system, such as outdated, excessive, or redundant access rights, segregation of duties conflicts, or unauthorized changes. Periodic
* review of access profiles can also help to ensure compliance with internal and external audit requirements and regulations.
* Implementation of additional PIN pads: This is a type of multi-factor authentication (MFA) that requires the cardholder to enter a personal identification number (PIN) in addition to swiping their card. MFA can enhance the security of the access control system by adding another layer of verification and reducing the risk of lost, stolen, or cloned cards being used by unauthorized persons.
* Installation of closed-circuit television (CCTV): This is a type of surveillance system that uses cameras and monitors to record and display the images of the people and activities in the restricted areas. CCTV can deter potential intruders, provide evidence of any security incidents or breaches, and enable real-time monitoring and response by security personnel.
The other options are not as effective or relevant as periodic review of access profiles by management for an additional control when using swipe cards. Physical sign-in of all employees for access to restricted areas is a redundant and inefficient control that can be easily bypassed or manipulated. It also does not provide any assurance or verification of the identity or access rights of the cardholders. Audit hooks are software routines embedded in an application that can trigger an alert or a report when certain conditions are met. Audit hooks can help to detect anomalies or exceptions in access control lists, but they do not provide a comprehensive or integrated view of them.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019, p. 236
* ISACA, ITAF: A Professional Practices Framework for IS Audit/Assurance, 3rd Edition, 2014, p. 88
* Data Analytics for Auditing Access Control

The greatest concern with this situation is that a business-critical application does not currently have any level of fault tolerance and thus has a single point of failure. A single point of failure is a component or element of a system that, if it fails, will cause the entire system to stop functioning. Fault tolerance is the ability of a system to continue operating without interruption or degradation in the event of a failure of one or more of its components or elements. Fault tolerance can be achieved by using techniques such as redundancy, replication, backup, or failover. A business-critical application should have a high level of fault tolerance to ensure its availability, reliability, and continuity. References:
* CISA Review Manual (Digital Version), Chapter 5, Section 5.51
* CISA Online Review Course, Domain 3, Module 3, Lesson 22

Comprehensive and Detailed Step-by-Step Explanation:
Risk acceptancemeanschoosing not to take immediate actionto mitigate the risk, making it thelowest- costapproach in the short term.
* Risk Acceptance (Correct Answer - B)
* The organizationacknowledges the riskand decides toaccept itwithout implementing additional controls.
* Example:A small companyaccepts the riskof not segregating financial duties due to limited staff.
* Risk Mitigation (Incorrect - A)
* Requiresimplementing controls, whichincur costs.
* Risk Transference (Incorrect - C)
* Involvesoutsourcing risk(e.g., buying insurance), which hasfinancial costs.
* Risk Reduction (Incorrect - D)
* Involvesapplying security controls, leading to additional costs.
References:
* ISACA CISA Review Manual
* ISO 31000 (Risk Management Framework)