Understanding the Audit Management Process ACCISO Practice Questions (Page 11)

Questions 51–55

1. 51application · medium

   A security manager is explaining to a new analyst how the audit management process supports information security governance. The manager wants to emphasize the role of the audit process in providing assurance. Which statement best describes this role?

   • AThe audit process provides independent assurance that security controls are operating effectively and that risks are being managed.
   • BThe audit process is a one-time activity that establishes a security baseline for the organization.
   • CThe audit process ensures that all security incidents are prevented from occurring.
   • DThe audit process is primarily a compliance exercise that does not add value to security governance.
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   An internal audit department wants to ensure the quality of its audits. The audit manager is considering implementing a peer review process. What is the primary benefit of peer review?

   • AIt allows the audit team to share the workload with other departments.
   • BIt reduces the time needed to complete the audit.
   • CIt provides an independent check that the audit work meets professional standards.
   • DIt guarantees that all findings will be accepted by management.
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   An audit finding required the implementation of a new access control system. Six months later, the auditee reports that the system is in place and provides a project closure document. The audit team has limited resources and cannot conduct a full re-audit. What is the most appropriate follow-up approach?

   • AConduct a limited, targeted review of the new access control system to verify its effectiveness.
   • BSchedule a full audit of the entire IT department to verify the finding.
   • CAccept the project closure document as sufficient evidence and close the finding.
   • DClose the finding based on the auditee's good faith and past performance.
   Reveal Solution Discussion Select an answer first
5. 54expert · hard

   An organization is implementing a new audit program for its IT processes. The audit manager must choose between using COBIT 2019 and ISO 27001 as the basis for the audit. The organization's primary goal is to align IT with business objectives while also ensuring security. What is the most appropriate decision?

   • AUse COBIT 2019 as the primary framework because it focuses on governance and aligning IT with business goals.
   • BUse ISO 19011 as the primary framework because it is an audit standard.
   • CUse both frameworks equally, combining all requirements into a single audit checklist.
   • DUse ISO 27001 as the primary framework because it is a security standard.
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   An auditor is reviewing evidence for a security control. The evidence includes an email from the system administrator stating that the control is working, a log extract, and a screenshot of the configuration. The auditor must determine the reliability of the evidence. Which piece of evidence is generally considered the most reliable?

   • AAll evidence is equally reliable
   • BThe log extract
   • CThe email from the system administrator
   • DThe screenshot of the configuration
   Reveal Solution Discussion Select an answer first