QUESTION: 229

What is the MAIN purpose of an organization's internal IS audit function?

Provide assurance to management about the effectiveness of the organization's risk management and internal controls.
Identify and initiate necessary changes in the control environment to help ensure sustainable improvement.
Review the organization's policies and procedures against industry best practice and standards.
Independently attest the organization's compliance with applicable legal and regulatory requirements.

Answer(s): A

Following a recent internal data breach, an IS auditor was asked to evaluate information security practices within the organization. Which of the following findings would be MOST important to report to senior management?

Employees are not required to sign a non-compete agreement.
Security education and awareness workshops have not been completed.
Users lack technical knowledge related to security and data protection.
Desktop passwords do not require special characters.

Answer(s): C

Show Answer Next Question

QUESTION: 231

A business unit cannot achieve desired segregation of duties between operations and programming due to size constraints. Which of the following is MOST important for the IS auditor to identify?

Unauthorized user controls
Compensating controls
Controls over operational effectiveness
Additional control weaknesses

Answer(s): B

Show Answer Next Question

QUESTION: 232

The BEST way to determine whether programmers have permission to alter data in the production environment is by reviewing:

the access control system's configuration.
how the latest system changes were implemented.
the access rights that have been granted.
the access control system's log settings.

Answer(s): C

Show Answer Next Question

Free ISACA CISA Exam Braindumps (page: 59)

QUESTION: 229

QUESTION: 230

QUESTION: 231

QUESTION: 232

CISA Exam Discussions & Posts