During an audit of a financial services firm, the auditor needs to verify that user access reviews are performed quarterly. The auditor has access to the access review reports for the past year. To efficiently gather sufficient evidence while maintaining a reasonable level of assurance, which sampling approach is most appropriate?

Review all 12 quarterly reports to ensure complete verification of the control.

Ask the access review owner to confirm verbally that all reviews were completed.

Select a random sample of 20% of the access review reports and examine them for completeness and approval signatures.

Only review the most recent report to confirm the control is currently operating.

An audit has identified a finding that the organization's disaster recovery plan has not been tested in over two years. The finding is rated as high risk. The audit report is being drafted. The auditee disagrees with the finding, claiming that the plan is adequate and testing is not required. How should the auditor handle this disagreement?

Include the finding in the report and document the auditee's response and the auditor's rationale.

Change the finding to a low risk to make it more acceptable to the auditee.

Delay the report until the auditee agrees with the finding.

Remove the finding from the report to avoid conflict with the auditee.

Which factor is typically considered when assessing audit risk?

The auditor's personal preferences

The color of the audit report cover

The likelihood and impact of control failures

The number of employees in the organization

After an audit, the IT department was required to implement multi-factor authentication (MFA) for all remote access within 90 days. At the 90-day mark, the CISO wants to verify that the corrective action has been completed. What is the most appropriate follow-up action?

Close the finding immediately because the deadline has passed and assume the action was completed.

Schedule a full re-audit of the remote access environment to confirm MFA is working.

Accept the IT department's verbal confirmation that MFA is now in place.

Request evidence of MFA implementation, such as configuration screenshots or user logs, and verify it against the audit recommendation.

EC-CouncilCertified Chief Information Security Officer

Domain 2Objective 4

Understanding the Audit Management Process CCISO Practice Questions (Page 11)

Part of the Information Security Controls and Audit Management domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~8–14 in this domain), expect 2–4 from this objective — we provide 61 practice questions to prepare you well beyond it. (estimate)

61questions here

13free pages

12concepts

Questions 51–55

51application · medium
During an audit of a financial services firm, the auditor needs to verify that user access reviews are performed quarterly. The auditor has access to the access review reports for the past year. To efficiently gather sufficient evidence while maintaining a reasonable level of assurance, which sampling approach is most appropriate?
Select an answer first
52expert · hard
An audit has identified a finding that the organization's disaster recovery plan has not been tested in over two years. The finding is rated as high risk. The audit report is being drafted. The auditee disagrees with the finding, claiming that the plan is adequate and testing is not required. How should the auditor handle this disagreement?
Select an answer first
53foundation · easy
Which factor is typically considered when assessing audit risk?
Select an answer first
54foundation · easy
Which document is typically created during audit planning and serves as a guide for the audit team?
Select an answer first
55application · medium
After an audit, the IT department was required to implement multi-factor authentication (MFA) for all remote access within 90 days. At the 90-day mark, the CISO wants to verify that the corrective action has been completed. What is the most appropriate follow-up action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Understanding the Audit Management Process CCISO Practice Questions (Page 11)

Questions 51–55

Which factor is typically considered when assessing audit risk?

Which document is typically created during audit planning and serves as a guide for the audit team?

After an audit, the IT department was required to implement multi-factor authentication (MFA) for all remote access within 90 days. At the 90-day mark, the CISO wants to verify that the corrective action has been completed. What is the most appropriate follow-up action?

Keep studying — Information Security Controls and Audit Management