* A. The policy for granting, modifying, and deleting user access:Correct. Understanding the policy ensures the auditor knows the framework and controls in place.
* B. A sample of change request forms:Useful for testing but not as foundational as reviewing the policy.
* C. User access reports reviewed by management:This evaluates monitoring but does not establish a baseline understanding of controls.
* D. A current listing of system users and employees:Important for reconciliation but secondary to understanding the control framework.
CIA Exam Syllabus Reference:
Domain V: Performing Internal Audit Services - Preliminary Surveys.