An entity is beginning its budget cycle. Approval of the capital budget by the board of directors is the first step in the process. Until final approval, only the CEO and division vice presidents have access to it. During the multiple iterations of the capital budget, hard copies are printed and distributed to authorized persons or their administrative assistants. Which of the following is the most effective procedure by an internal auditor to gain assurance that IT personnel are not distributing the capital budget reports to unauthorized employees?
1. Interviewing IT personnel responsible for programming the budgetary applications.
2. Interviewing computer operations personnel and reviewing logs of abnormal program terminations.
3. Reviewing the log signed by those receiving the reports.
4. Interviewing all authorized personnel or their administrative assistants to determine whether they received the reports.