The best recommendation for an IS auditor who finds that one employee has unauthorized access to confidential data is to require the business owner to conduct regular access reviews. Access reviews are periodic assessments of user access rights and permissions to ensure that they are appropriate, necessary, and aligned with the business needs and objectives. Access reviews help to identify and remediate any unauthorized, excessive, or obsolete access that could pose a security risk or violate compliance requirements.
The business owner is responsible for defining and approving the access requirements for their data and ensuring that they are enforced and monitored. References:
* CISA Review Manual (Digital Version)
* CISA Questions, Answers & Explanations Database

A business impact analysis (BIA) is the process of identifying and assessing the potential impacts a disruption or incident could have on an organization. A BIA helps organizations understand and prepare for these potential obstacles, so they can act quickly and face challenges head-on when they arise. A BIA tells the organization what to expect when unforeseen roadblocks occur, so they can make a plan to get their business back on track as quickly as possible. Therefore, a BIA is the best option to anticipate the effects of a disaster.
References:
* 10: Business Impact Analysis (BIA): Prepare for Anything [2023] * Asana
* 11: Definition of Business Impact Analysis (BIA) - IT Glossary | Gartner Information Technology
* 12: Business impact analysis (BIA) is a method to predict the consequences of disruptions to a business, its processes and systems by collecting relevant data.