The most efficient way to identify segregation of duties violations in a new system is to review a report of security rights in the system. Segregation of duties is a control principle that aims to prevent or detect errors, fraud, or abuse by ensuring that no single individual has the ability to perform incompatible or conflicting functions or activities within a system or process. A report of security rights in the system can provide a comprehensive and accurate overview of the roles, responsibilities, and access levels assigned to different users or groups in the system, and can help to identify any potential segregation of duties violations or risks. The other options are not as efficient as reviewing a report of security rights in the system, because they either rely on observation or testing rather than analysis, or they focus on existing rather than potential violations. References: CISA Review Manual (Digital Version)1, Chapter 5, Section 5.2.2

Section: Information System Acquisition, Development and Implementation

Section: Protection of Information Assets
Explanation:
Deleting and formatting does not completely erase the data but only marks the sectors that contained files
as being free. There are tools available over the Internet which allow one to reconstruct most of a hard
disk's contents. Overwriting a hard disk at the sector level would completely erase data, directories, indices
and master file tables. Reformatting is not necessary since all contents are destroyed. Overwriting several
times makes useless some forensic measures which are able to reconstruct former contents of newly
overwritten sectors by analyzing special magnetic features of the platter's surface. While hole-punching
does not delete file contents, the hard disk cannot be used anymore, especially when head parking zones
and track zero information are impacted. Reconstructing data would be extremely expensive since all
analysis must be performed under a clean room atmosphere and is only possible within a short time frame
or until the surface is corroded. Data reconstruction from shredded hard disks is virtually impossible,
especially when the scrap is mixed with other metal parts. If the transport can be secured and the
destruction be proved as described in the option, this is a valid method of disposal.