Instead of granting individual accounts adminstrative rights, a company users shared privileged accounts to execute change management for critical applications. Which is the most effective control to reduce the risk in the scenario?

Ensure that supervisory approval and review are performed for critical changes.

Routine personnel background checks are performed for critical personnel.

Ensure that audit trails for the privileged accounts are accurate and specific.

Validate that personnel have adequate training.

Explanation

Supervisory approval and review of critical changes by accountable managers in the enterprise are required to avoid any unauthorized change. In addition to authorization, supervision enforces a separation of duties and prevents an unauthorized attempt by any single employee. Audit trails are a detective control and canin many casesbe altered by those with privileged access. Staff integrity, not proficiency, may be somewhat of a deterrent, but supervisory approval and review is the best choice.