Isaca Certification CISM Reddit Questions

The correct answer is D because an independent security audit provides objective assurance about the performance and effectiveness of the information security program. Senior management needs reliable, high-level information to evaluate whether the program is achieving its objectives, managing risk appropriately, and supporting business goals. An independent audit can assess governance, controls, compliance, risk management, operations, and program maturity from an unbiased perspective. The number of policy exceptions is useful as a metric, but it gives only a narrow view of compliance behavior. The number of incidents identified and remediated may show operational activity, but it does not fully measure program effectiveness. Vulnerability scan results are technical and limited to specific systems or environments; they do not provide an enterprise-level view of program performance. CISM governance emphasizes management reporting, independent assurance, accountability, and performance evaluation. Therefore, among the listed options, independent security audit results are the most useful for reporting overall program performance to senior management.

The business impact analysis (BIA) is the foundational step in disaster recovery planning. The CISM Review Manual states that BIA should be performed first to determine critical business functions, recovery priorities, and the impact of disruptions. Risk assessments and documentation follow after the BIA.

The primary purpose of identifying vulnerabilities is to remediate them before they can be exploited by malicious actors. While risk reporting and prioritization are part of the overall process, the most immediate goal is remediation.

“Vulnerability assessments identify weaknesses that need to be addressed to reduce risk to acceptable levels and prevent potential exploits.”

— CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Assessment and Analysis

This aligns with ISACA’s official practice questions, where vulnerability identification directly aims to prevent exploitation.

The correct answer is D because system-level risk is calculated or assessed by considering threats, vulnerabilities, likelihood, impact, and existing controls related to a specific system. Vulnerabilities are weaknesses that may be exploited by threats and are therefore direct inputs into determining risk. Key risk indicators are useful for monitoring changes in risk exposure over time, but they are generally reporting or monitoring measures rather than primary calculation inputs. A business impact analysis helps determine the effect of disruption on business processes and may support impact evaluation, but it is not by itself a system-level risk input. System risk appetite defines how much risk may be acceptable, but it does not calculate the risk itself; it is used to evaluate whether calculated or assessed risk is acceptable. In CISM risk management, risk assessment requires identifying assets, threats, vulnerabilities, likelihood, impact, and controls. Since vulnerabilities directly influence the likelihood and potential success of exploitation, system vulnerabilities are the best answer.