CISA Exam Questions Tutorials

The primary advantage of this approach is that it improves audit efficiency. Audit efficiency is the measure of how well the audit resources are used to achieve the audit objectives. Audit efficiency can be enhanced by using methods or techniques that can save time, cost, or effort without compromising the quality or scope of the audit. By requesting direct access to data required to perform audit procedures instead of asking management to provide the data, the auditor can reduce the dependency on management’s cooperation, availability, or timeliness. The auditor can also avoid potential delays, errors, or biases that may occur when management provides the data. References:

CISA Review Manual (Digital Version), Chapter 2, Section 2.41

CISA Online Review Course, Domain 1, Module 1, Lesson 42

The best indication to an IS auditor that management’s post-implementation review was effective is that lessons learned were documented and applied, as this shows that the management has identified and addressed the issues and gaps that arose during the implementation, and has improved the processes and practices for future projects. Business and IT stakeholders participating in the post-implementation review is a good practice, but it does not guarantee that the review was effective or that the outcomes were implemented. Post-implementation review being a formal phase in the system development life cycle (SDLC) is a requirement, but it does not ensure that the review was effective or that the outcomes were implemented. Internal audit follow-up being completed without any findings is a desirable result, but it does not indicate that the management’s post-implementation review was effectiveorthat the outcomes were implemented. References: CISA Review Manual (Digital Version), Chapter 3: Information Systems Acquisition, Development andImplementation, Section 3.2: Project Management Practices1

The best source of information for an IS auditor to use when determining whether an organization’s information security policy is adequate is the risk assessment results. The risk assessment results provide the auditor with an overview of the organization’s risk profile, including the identification, analysis, and evaluation of the risks that affect the confidentiality, integrity, and availability of the information assets. The auditor can use the risk assessment results to compare the organization’s information security policy with the risk appetite, risk tolerance, and risk treatment strategies of the organization. The auditor can also use the risk assessment results to evaluate if the information security policy is aligned with the organization’s objectives, requirements, and regulations.

Some of the web sources that support this answer are:

Performance Measurement Guide for Information Security

ISO 27001 Annex A.5 - Information Security Policies

[CISA Certified Information Systems Auditor – Question0551]