Understanding the Audit Management Process CCISO Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An auditor is testing whether terminated employees' accounts are disabled within 24 hours. The organization has 5,000 employees and a history of occasional delays in account termination. The auditor wants to determine the effectiveness of the control with a high level of confidence. Which sampling method is most appropriate?

   • AUse a judgmental sample of terminations that the auditor believes are most likely to have issues.
   • BReview all termination records from the past year to ensure complete coverage.
   • CSelect only the most recent terminations to check the current state of the control.
   • DSelect a random sample of terminated employee records from the past year and verify the account disablement timestamps.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   During audit planning, the audit team identifies that the organization has a high turnover rate in the IT department and that the change management process has had several recent failures. How should the audit team use this information?

   • AUse this information to increase the sample size for testing change management controls.
   • BAdjust the audit schedule to avoid the IT department during the audit.
   • CReport this information to management as a finding before the audit begins.
   • DIgnore this information because it is not directly related to the audit objectives.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Why is effective communication important during the audit process?

   • AIt helps manage expectations and build trust with stakeholders
   • BIt allows the auditor to avoid sharing negative findings
   • CIt ensures that the audit report is written in a complex manner
   • DIt guarantees that all stakeholders agree with the audit conclusions
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of the audit report?

   • ATo assign blame for control failures
   • BTo communicate audit findings, conclusions, and recommendations to stakeholders
   • CTo replace the need for management review of security controls
   • DTo provide a detailed list of all evidence collected during the audit
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An external auditor is about to begin an audit of a manufacturing company's IT systems. The auditor needs to ensure that the audit runs smoothly and that stakeholders are engaged. What is the most effective communication strategy at the start of the audit?

   • AKeep the audit plan confidential to prevent auditees from preparing or hiding issues.
   • BSend a detailed audit plan to all employees, including the audit schedule and testing procedures.
   • CHold an opening meeting with key stakeholders to explain the audit scope, objectives, and process.
   • DCommunicate only with the CEO to avoid disrupting operations.
   Reveal Solution Discussion Select an answer first