Which of the following controls most likely could prevent EDP personnel from modifying programs to bypass programmed controls?

• A. Periodic management review of computer utilization reports and systems documentation
• B. Segregation of duties within EDP for computer programming and computer operations
• C. Participation of user department personnel in designing and approving new systems
• D. Physical security of EDP equipment

Answer: (B)

Segregation of duties between programming and computer operations is the best preventive control here. When the people who write or modify software are separate from those who run and maintain the production systems, no single individual has the authority to both alter a program and bypass its programmed controls. Changes must go through a formal process—development, testing, approval, and production deployment—often with a change-control board and audit trails. This multi-person, documented workflow creates checks and accountability, making it much harder for someone to slip in a covert modification that defeats controls.

Periodic management review of utilization reports and documentation is valuable for detecting unusual activity, but it doesn’t stop the modification from being made in the first place. Involving user department personnel in system design helps with usability and controls design but doesn’t directly prevent an insider from changing code. Physical security of equipment protects hardware from tampering, but once someone has access to the software environment, segregation of duties is what prevents the software itself from being secretly altered to bypass controls.