Understanding the Audit Management Process ACCISO Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of effective coordination with the auditee during audit execution?

   • ARequesting all evidence without prior notice to test the auditee's readiness.
   • BKeeping the auditee unaware of the audit scope until the final report.
   • CConducting interviews without documenting the responses.
   • DScheduling meetings and interviews at mutually convenient times.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During an audit of a cloud migration project, the auditor interviews the system administrator who claims that all access to the cloud console is logged. The auditor needs to verify this claim. Which action should the auditor take during fieldwork?

   • ADocument the administrator's claim in the working papers and move on to the next control.
   • BAsk the administrator to sign a formal statement confirming the logging is enabled.
   • CAccept the administrator's statement as sufficient evidence because they are the system owner.
   • DRequest a sample of cloud console logs and independently verify that they capture the relevant access events.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During an audit of a financial services firm, an auditor is collecting evidence about the effectiveness of the change management process. The auditor has obtained a sample of change tickets, but the system log that records approvals is not timestamped. According to audit standards such as ISO 19011, what should the auditor do?

   • AReject the entire sample and report that the change management process is ineffective.
   • BAsk the IT team to add timestamps to the historical log entries retroactively.
   • CIgnore the missing timestamps because the change tickets themselves are sufficient evidence of the process.
   • DDocument the lack of timestamps as a finding and rely on other corroborating evidence, such as email approvals, to support the audit conclusion.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   During audit planning, which of the following is a key consideration when defining the audit scope?

   • AThe boundaries of the audit, including the systems, processes, locations, and time period to be covered.
   • BThe list of employees who will receive commendations for their cooperation.
   • CThe number of audit findings expected to be generated during the audit.
   • DThe personal preferences of the audit team regarding which areas are most interesting.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary role of the audit management process in information security governance?

   • ATo enforce security policies by directly implementing technical controls across the organization.
   • BTo replace the need for continuous monitoring by providing a single point-in-time assessment.
   • CTo provide independent, objective assurance and insight into the effectiveness of risk management, control, and governance processes.
   • DTo guarantee that all security incidents are prevented and that no breaches occur.
   Reveal Solution Discussion Select an answer first