Section: Information System Acquisition, Development and Implementation

Allowing transferred staff to retain access from previous roles violates the principle of least privilege and increases the risk of inappropriate access. This creates a greater likelihood that internal fraud or unauthorized activities could occur without detection, as users may retain access to systems or data unrelated to their current responsibilities.

Direct access attacks make use of common consumer devices that can be used to transfer data surreptitiously. Someone gaining physical access to a computer can install all manner of devices to compromise security, including operating system modifications, software worms, keyboard loggers, and covert listening devices. The attacker can also easily download large quantities of data onto backup media or portable devices.

Comprehensive and Detailed Explanation:
The primary audit concern is data integrity-ensuring that the data uploaded via the custom interface is accurately and completely transferred to the financial system.
* Option A directly addresses data accuracy and integrity.
* Option B (timing) is secondary compared to correctness.
* Option C (malware checks) is important but handled by security controls, not the primary audit concern here.
* Option D (duplex communication) is irrelevant to ensuring accurate financial records.
# ISACA Reference: CISA Review Manual 27th Edition, Domain 3, section on interface controls and audit considerations.