Understanding the Audit Management Process CCISO Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of audit follow-up?

   • ATo re-audit the entire organization
   • BTo monitor and verify that corrective actions have been implemented
   • CTo assign penalties for non-compliance
   • DTo collect additional evidence for the original audit report
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An internal audit team is about to begin an audit of the organization's change management process. The IT operations manager is known to be resistant to audits and may not cooperate fully. What is the most effective communication strategy for the audit team to use with this stakeholder?

   • ASend a formal notice that the audit is mandatory and non-negotiable.
   • BAsk the manager's supervisor to order them to cooperate with the audit.
   • CSchedule a pre-audit meeting to explain the audit's purpose, scope, and how the results will be used to improve controls.
   • DProceed with the audit without informing the manager to avoid confrontation.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   During an audit of a financial services firm, the auditor needs to verify that access to customer records is properly restricted. The auditor has limited time and must gather sufficient evidence. Which combination of evidence-gathering techniques is most effective and efficient?

   • AInterview the IT manager about the access control process and rely on their assurance that controls are working.
   • BReview the access control policy and compare it to a sample of user access rights from the system.
   • COnly test the access controls for the IT department because they are the most privileged users.
   • DPerform a full population review of all user access rights without sampling.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which activity is part of audit quality assurance?

   • AConducting a peer review of audit work
   • BDefining the audit scope
   • CCollecting audit evidence
   • DImplementing corrective actions
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A newly appointed CISO wants to establish an audit management process for the organization's information security program. The organization has never had formal audits. What is the first step the CISO should take to build an effective audit management process?

   • APurchase an audit management software tool to automate the process.
   • BHire external auditors to perform a comprehensive security assessment.
   • CDevelop an audit charter that defines the purpose, authority, and responsibility of the audit function.
   • DConduct an audit of the most critical systems immediately to identify vulnerabilities.
   Reveal Solution Discussion Select an answer first