Explanation/Reference:
Logical access controls should be reviewed to ensure that access is granted on a least-privilege basis, per the organization's data owners.

The best approach for an IS auditor to evaluate whether the IT strategy supports the organization's vision and mission is to meet with senior management to understand the business goals and how IT can enable them.
This will help the IS auditor to assess the alignment and integration of IT with the business strategy and to identify any gaps or opportunities for improvement. Reviewing ROIs, KPIs, or feedback from other departments may provide some insights, but they are not sufficient to evaluate the IT strategy. References: IS Audit and Assurance Standards, section "Standard 1201: Engagement Planning"

Section: Protection of Information Assets
Explanation:
The audit policy should include guidelines detailing what involvement internal audit will have in the
development, acquisition, conversion, and testing of major applications. Such a policy must be approved by
top management for it to be effective.