A client that recently installed a new accounts payable system assigned employees a user identification code (UIC) and a separate password. Each UIC is a person's name, and the individual's password is the same as the UIC. Users are not required to change their passwords at initial log-in nor do passwords ever expire. Which of the following statements does not reflect a limitation of the client's computer access control?

Question

Quizplus · Accepted Answer

Choice "D" is correct. The requirement that employees take regular vacations is a good internal control, but it is unrelated to computer-access controls. Choice "A" is incorrect. Using employee's names as their passwords is an ineffective computer-access control, because passwords are easily guessed. Choice "B" is incorrect. It would be acceptable to assign employee names as passwords, as long as the employees were required to change their passwords at initial log-in as well as periodically in the future. The fact that this requirement is not in place is a limitation of the client's computer-access controls. Choice "C" is incorrect. If password controls are used to segregate the duties of individual employees, using employee names as passwords allows an employee to circumvent this segregation by logging in with another employee's password.

A Client That Recently Installed a New Accounts Payable System