Isaca CISA Actual Questions

The correct answer is D. Establish a global IT risk scoring criteria.

When business units use different risk methods, their risk scores are not comparable. One unit’s “high” risk may not mean the same thing as another unit’s “high” risk. The organization first needs a common risk scoring method so IT risks can be measured, compared, aggregated, and reported consistently across the enterprise.

Option A is not the best first approach because a weighted score is only useful after the organization has consistent scoring criteria. Option B is not appropriate because choosing the highest-rated risk may overstate overall risk appetite and may be based on inconsistent rating methods. Option C is also inappropriate because averaging inconsistent risk scores can produce misleading results.

ISACA’s glossary defines risk appetite as the amount of risk an entity is prepared to accept when pursuing its objectives. ISACA also discusses risk appetite in terms of identifying risk the organization is or is not willing to accept in relation to its values, digital strategy, stakeholder impact, and required actions.

This maps to Governance and Management of IT because risk appetite, IT risk management, risk reporting, and governance decision-making are Domain 2 topics in the CISA Exam Content Outline.

Audit planning is the process of developing an overall strategy and approach for conducting an audit. Audit planning involves identifying the objectives, scope, criteria, and methodology of the audit, as well as the resources, schedule, and reporting requirements. Audit planning also involves performing a risk assessment to identify and prioritize the areas of highest risk and significance for the audit1.

Risk assessment is a systematic process of evaluating the potential risks that may be involved in a projected activity or undertaking. Risk assessment involves identifying the sources and causes of risk, analyzing the likelihood and impact of risk, and determining the level of risk and the appropriate response2.

During audit planning, the IS audit manager is considering whether to budget for audits of entities regarded by the business as having low risk. The best course of action in this situation is C. Validate the low-risk entity ratings and apply professional judgment.

This is because validating the low-risk entity ratings can help to ensure that the risk assessment is accurate, reliable, and consistent with the business objectives and expectations. Validating the low-risk entity ratings can also help to identify any changes or developments that may affect the risk profile of the entities since the last assessment. Applying professional judgment can help to determine whether the low-risk entities should be included or excluded from the audit plan, based on factors such as materiality, relevance, significance, and assurance needs3.

Open-source solutions provide flexibility and reduce vendor lock-in, allowing organizations to modify, enhance, and support software independently.

Option A (Incorrect):Open-source software often lacksformalizedsupport levels compared to proprietary solutions, which provide structured SLAs (Service Level Agreements).

Option B (Incorrect):While some open-source solutions are user-friendly, implementation complexity depends on the software and required customization.

Option C (Correct):A key benefit of open-source solutions is thefreedom from vendor dependence. Organizations can customize the software, hire independent developers, or switch providers without being locked into a specific vendor ' s ecosystem.

Option D (Incorrect):Security in open-source software depends on the community and organization managing the solution. Some open-source tools have excellent security, while others may require additional hardening.