6.4 Coordinate with Auditors and Regulators in Support of Internal and External Audit Processes ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has implemented a new security awareness training program as part of its remediation of an audit finding. The compliance officer needs to monitor the effectiveness of the training. What is the most appropriate metric to track?

   • AThe amount of time employees spend on the training.
   • BThe percentage of employees who pass a post-training assessment.
   • CThe number of employees who completed the training.
   • DThe reduction in the number of security incidents related to human error.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is stakeholder consultation important when validating audit findings?

   • ATo gain additional context and confirm the finding's accuracy
   • BTo determine the audit budget
   • CTo find someone to blame for the finding
   • DTo convince stakeholders to hide the finding
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has implemented a new security control to remediate an audit finding. The compliance officer is responsible for monitoring the remediation. The control is complex and involves multiple departments. What is the most effective approach to monitor the remediation?

   • AEstablish a remediation tracking system that includes milestones, owners, and status updates, and review it regularly.
   • BAssign a single project manager to oversee the remediation and report progress to the compliance officer on a weekly basis.
   • CWait until the remediation is complete and then verify that the control is working.
   • DAsk the auditors to monitor the remediation on behalf of the company.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which activity is an example of coordinating audit activities?

   • AScheduling interviews between auditors and system owners
   • BDeciding which findings to include in the final report
   • CWriting the audit report for the auditors
   • DSetting the audit objectives
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company is planning for an external audit that will require interviews with key personnel and access to specific systems. The audit is scheduled to occur during the company's busiest season. What is the most appropriate action for the compliance officer?

   • AInform the auditors that the audit cannot occur during the busy season and request an extension.
   • BProvide the auditors with remote access to the systems so they can conduct the audit without needing to interview personnel.
   • CCoordinate with the auditors to adjust the audit schedule to minimize disruption, such as scheduling interviews during off-peak hours.
   • DReschedule the audit to a less busy time of year, even if it means delaying the audit by several months.
   Reveal Solution Discussion Select an answer first