システムの問題を解決するために、緊急修正が必要となる場合があります。これには、緊急時にプログラマーが本番プログラムに一時的にアクセスできるようにする特別なログオンIDの使用が含まれます。緊急変更は、事後的なフォローアップ手順を使用して完了する必要があります。これにより、通常の手順が遡及的に適用されることが保証されます。そうしないと、本番環境に影響が出る可能性があります。このようにして行われた変更は、緊急ライブラリに保管し、通常の変更管理プロセスに従って本番ライブラリに移動する必要があります。プログラマーは本番ライブラリを直接変更してはならず、また、本番プログラムへの永続的なアクセス権も付与されてはなりません。

Concurrency controls are used as a countermeasure for potential database corruption when two processes attempt to simultaneously edit or update the same information.

A database administrator (DBA) should be prevented from having end user responsibilities to avoid a conflict of interest and a violation of the principle of segregation of duties. End user responsibilities may include initiating transactions, authorizing transactions, recording transactions or reconciling transactions. A DBA who has end user responsibilities may compromise the integrity, confidentiality and availability of the data and the database systems. Accessing sensitive information, having access to production files and using an emergency user ID are not end user responsibilities, but rather potential risks or controls associated with the DBA role. References:
* : Database Administrator (DBA) Definition
* : Segregation of Duties | ISACA
* : [End User Definition]

The best recommendation for an IS auditor who finds that one employee has unauthorized access to confidential data is to require the business owner to conduct regular access reviews. Access reviews are periodic assessments of user access rights and permissions to ensure that they are appropriate, necessary, and aligned with the business needs and objectives. Access reviews help to identify and remediate any unauthorized, excessive, or obsolete access that could pose a security risk or violate compliance requirements.
The business owner is responsible for defining and approving the access requirements for their data and ensuring that they are enforced and monitored. References:
* CISA Review Manual (Digital Version)
* CISA Questions, Answers & Explanations Database