Which of the following should be of GREATEST concern for an IS auditor when reviewing...

Comprehensive and Detailed Step-by-Step Explanation:

Failure torevoke access upon terminationposes the greatest security risk, as ex-employees could still access sensitive data or systems.

No Policy to Revoke Access (Correct Answer – A)

A terminated employee retaining access can lead todata breaches or insider threats.

Example:A former employee misuses active credentials to access financial systems.

Lack of Security Awareness Training (Incorrect – B)

Important but does not pose an immediate security risk like an active ex-employee account.

No NDAs (Incorrect – C)

Protects intellectual property but is not as critical as system access.

No Access Revocation for Role Changes (Incorrect – D)

Still a concern, but ex-employees with active access are ahigherrisk.

References:

ISACA CISA Review Manual

NIST 800-53 (Access Control)