Understanding the Audit Management Process ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An audit team is conducting an audit of a third-party vendor's security controls. The vendor is located in a different country and has different working hours. The audit manager needs to ensure that the audit is completed on time while maintaining effective communication. What is the most effective strategy?

   • ARequire the vendor to be available during the audit team's working hours.
   • BSchedule regular status meetings at times that overlap with the vendor's working hours and use asynchronous communication for other updates.
   • CCommunicate exclusively through email to avoid scheduling conflicts.
   • DConduct the audit entirely remotely without any real-time communication.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization is preparing for an external audit. The audit manager has assigned an internal coordinator to facilitate the audit. What is the primary responsibility of the internal coordinator?

   • AAct as the single point of contact for the external auditors, scheduling meetings and providing access to necessary personnel and documents.
   • BMake decisions about audit findings and recommendations.
   • CEnsure that the audit report is favorable to the organization.
   • DConduct the audit on behalf of the external auditors to save time.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   After an audit report is issued, the auditee implements a fix for a high-risk finding. The audit manager is responsible for verifying the remediation. Which action best demonstrates proper follow-up?

   • AClose the finding automatically because the auditee has a good track record.
   • BWait until the next scheduled audit to verify the fix.
   • CReview the auditee's self-assessment and close the finding if they state it is fixed.
   • DConduct a targeted re-test of the control to confirm the fix is effective and document the evidence.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security manager is planning an internal audit of the organization's access control processes. The audit team has limited resources and must complete the audit within two weeks. The manager needs to ensure that the audit focuses on the most critical areas while keeping stakeholders informed. What should the manager do first?

   • ASend a detailed audit plan to all stakeholders before identifying the audit objectives.
   • BAssign all available auditors to review every access control process equally to avoid missing any issues.
   • CConduct a risk assessment to prioritize audit areas and define the audit scope based on the highest-risk processes.
   • DImmediately begin fieldwork to gather evidence, then determine the scope based on what is found.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During an audit, the auditee disagrees with a preliminary finding and refuses to provide additional evidence. The auditor believes the finding is valid. What should the auditor do?

   • AEscalate the issue to the auditee's manager and demand that the evidence be provided.
   • BChange the finding to a recommendation to make it more acceptable to the auditee.
   • CRemove the finding from the report to avoid conflict with the auditee.
   • DDocument the disagreement and the auditee's refusal, and include the finding in the report with a note about the auditee's position.
   Reveal Solution Discussion Select an answer first