What is the difference between a system audit and an end-user audit?

What is the difference between a system audit and an end-user audit?

• A. System audit focuses on end-user activity; end-user audit on configuration.
• B. System audit focuses on configuration, access control, and system health; end-user audits focus on user activity.
• C. System audit covers finances; end-user audit covers training.
• D. System audit tests external interfaces; end-user audit tests reporting.

Answer: (B)

The key idea is what each type of audit examines: the system itself versus the people using it. A system audit focuses on the technology environment—how the system is configured, who has access and how access is controlled, the health and security controls of the system, and the integrity of logs and changes. It’s about the IT setup and its safeguards. An end-user audit, on the other hand, looks at what users actually did—who performed which actions, when, from where, and whether those actions complied with policy and procedure. It’s about tracing user activity and accountability. This is why the correct option is best: it clearly assigns the system audit to configuration, access control, and system health, and the end-user audit to user activity. The other choices mix up these focus areas or bring in topics like finances, training, or external interfaces, which aren’t the primary distinction between system-level audits and end-user audits.

The key idea is what each type of audit examines: the system itself versus the people using it. A system audit focuses on the technology environment—how the system is configured, who has access and how access is controlled, the health and security controls of the system, and the integrity of logs and changes. It’s about the IT setup and its safeguards.

An end-user audit, on the other hand, looks at what users actually did—who performed which actions, when, from where, and whether those actions complied with policy and procedure. It’s about tracing user activity and accountability.

This is why the correct option is best: it clearly assigns the system audit to configuration, access control, and system health, and the end-user audit to user activity. The other choices mix up these focus areas or bring in topics like finances, training, or external interfaces, which aren’t the primary distinction between system-level audits and end-user audits.