Understanding the Audit Management Process ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   After an audit, the auditee has implemented corrective actions for the identified findings. The audit manager is responsible for verifying that the remediation is effective. What should the audit manager do to formally close the audit?

   • AReview the evidence of remediation, perform a follow-up verification, and document the closure decision.
   • BRe-audit the entire scope of the original audit to ensure no new issues have arisen.
   • CAccept the auditee's written confirmation that the corrective actions are complete without further verification.
   • DClose the audit immediately after the corrective actions are implemented, without reviewing the evidence.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Why is effective communication with stakeholders important during the audit lifecycle?

   • AIt ensures that the audit runs smoothly and that stakeholders understand the audit's purpose and progress.
   • BIt helps auditors avoid collecting evidence that might be unfavorable.
   • CIt is required to obtain legal approval for the audit.
   • DIt allows auditors to influence stakeholders' opinions in favor of the audit findings.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An organization is establishing an internal audit program for its IT governance processes. The audit team wants to use a framework that provides guidance on managing an audit program and conducting audits, including how to evaluate auditor competence. Which framework should they adopt?

   • AISO 27001, which specifies requirements for an information security management system and includes audit requirements.
   • BISO 19011, which provides guidelines for auditing management systems, including audit program management and auditor competence.
   • CCOBIT, which focuses on IT governance and management objectives but does not provide detailed audit process guidance.
   • DNIST SP 800-53, which provides a catalog of security controls but not audit process guidance.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   During an audit, the auditor discovers that the evidence for a key control is a single configuration screenshot provided by the system administrator. The auditor suspects the screenshot may have been altered. The audit manager must decide how to proceed. What is the most appropriate action?

   • ADiscard the screenshot and report a finding based on the suspicion alone.
   • BAccept the screenshot as sufficient evidence because it appears to show the correct configuration.
   • CAsk the administrator to sign a statement confirming the screenshot is authentic.
   • DRequest independent evidence, such as a direct review of the live configuration or logs, to corroborate the screenshot.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which activity is part of audit fieldwork during execution?

   • APerforming testing procedures to verify the effectiveness of controls.
   • BDefining the audit objectives and scope.
   • CTracking the status of corrective actions.
   • DIssuing the final audit report to management.
   Reveal Solution Discussion Select an answer first