Understanding the Audit Management Process ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which action is part of formally closing an audit?

   • ADeveloping the audit program and schedule.
   • BConducting the opening meeting with the auditee.
   • CCollecting evidence to support preliminary findings.
   • DDocumenting that all agreed corrective actions have been completed and accepted.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An organization is planning an audit of its IT operations. The audit team is considering using a risk-based approach to prioritize audit areas. However, the organization's compliance department insists that the audit must cover all regulatory requirements equally. How should the audit manager reconcile these conflicting requirements?

   • AUse a risk-based approach to prioritize areas, but ensure that all mandatory regulatory requirements are included in the audit scope.
   • BUse only the risk-based approach and exclude regulatory requirements that are not high-risk.
   • CAsk the compliance department to approve the risk-based approach and drop the equal coverage requirement.
   • DFollow the compliance department's requirement and audit all areas equally, ignoring risk prioritization.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An audit manager is reviewing the work of a junior auditor who conducted fieldwork for a security audit. The junior auditor's working papers contain several errors and incomplete testing. What should the audit manager do to ensure audit quality?

   • ARemove the junior auditor from the audit team and assign a more senior auditor to redo the work.
   • BRewrite the working papers for the junior auditor without discussing the errors.
   • CIssue the report as is, because the junior auditor is responsible for the work.
   • DProvide constructive feedback and require the junior auditor to correct the working papers and complete the testing before the report is issued.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A new CISO is explaining the audit management process to the board of directors. The CISO wants to emphasize that the process is not a one-time event but a continuous cycle. Which statement best describes the overall audit management process?

   • AIt is a one-time project that establishes a baseline for security controls.
   • BIt is a linear process that ends with the issuance of the audit report.
   • CIt is a reactive process that only occurs when a security incident is discovered.
   • DIt is a cyclical process that includes planning, execution, reporting, follow-up, and closure, and then feeds into the next audit cycle.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which role is responsible for ensuring that audit findings are addressed and that appropriate resources are allocated for remediation?

   • AThe external certification body.
   • BThe lead auditor.
   • CThe auditee.
   • DSenior management.
   Reveal Solution Discussion Select an answer first