Understanding the Audit Management Process CCISO Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An internal audit department has been criticized for inconsistent audit quality across its teams. Some auditors follow a detailed process, while others rely on experience and informal methods. The CISO wants to improve consistency and quality. What is the most effective approach?

   • AProvide additional training to the less experienced auditors and leave the experienced ones alone.
   • BConduct a peer review of all audit reports after issuance to catch errors.
   • CDevelop and enforce standardized audit methodologies, templates, and quality review checklists.
   • DEncourage auditors to use their professional judgment and not be constrained by formal processes.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   During audit planning, the audit team identifies that the organization has recently undergone a major merger and that the IT integration is still in progress. The audit team has limited resources. How should the audit team prioritize its audit areas?

   • AAudit all areas equally to ensure no area is neglected.
   • BDelay the audit until the merger integration is complete.
   • CFocus on the areas that are easiest to audit to complete the audit quickly.
   • DPrioritize the areas most affected by the merger, such as access controls and data integration.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An internal audit has identified a critical finding regarding inadequate encryption of customer data at rest. The audit report is being prepared for the board of directors. What is the most appropriate way to communicate this finding?

   • ADelay the report until the finding is fully remediated so the report shows no unresolved issues.
   • BOnly report the finding verbally to the CEO and not include it in the written report to avoid alarming the board.
   • CDescribe the finding in terms of business risk, potential impact, and recommended actions, avoiding excessive technical jargon.
   • DInclude the technical details of the encryption algorithm and key management process in the report.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   After an audit, management implemented a corrective action to address a finding, but the implementation was incomplete. The audit team is verifying the corrective action. What is the most appropriate follow-up action?

   • AClose the finding because management has made an effort to implement the action.
   • BReopen the finding and work with management to develop a new corrective action plan.
   • CEscalate the issue to the board immediately without further discussion.
   • DAccept the incomplete action and note it in the next audit report.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an audit of a manufacturing company's IT systems, the auditor needs to understand the process for granting access to the production scheduling system. The system administrator is the primary contact. What is the most appropriate way for the auditor to gather this information?

   • ASend a survey to all system users asking how they received access.
   • BObserve the system administrator performing the access granting process without asking questions.
   • CRequest a copy of the system's audit logs and analyze them for access patterns.
   • DConduct an interview with the system administrator and request relevant documentation such as access request forms and approval records.
   Reveal Solution Discussion Select an answer first