CISA Study Notes
Who is responsible for imposing an IT governance model encompassing IT strategy,
information security, and formal enterprise architectural mandates? - ✅ IT executives
and the Board of Directors
The party that performs strategic planning, addresses near-term and long-term
requirements aligning business objectives, and technology strategies. - ✅ The Steering
Committee
What three elements allow validation of business practices against acceptable
measures of regulatory compliance, performance, and standard operational guidelines.
- ✅ (1.) Polices (2.) Procedures (3.) Standards
What activity involves the identification of potential risk and the appropriate response for
each threat based on impact assessment using qualitative and/or quantitative measures
for an enterprise-wide risk management strategy? - ✅ Risk Management
IT Governance is most concerned with.... - ✅ IT Strategy
Describe the advantages of outsourcing. - ✅ Outsourcing is an opportunity for the
organization to focus on core competencies. When an organization oursources a
business function, it no longer needs to be concerned about training employees in that
function. Outsources does not always reduce costs, because cost reduction is not
always the primary goal of oursourcing.
An external IS auditor has discovered a segregation of duties issue in a high value
process. What is the best action for the auditor to take? - ✅ The external auditor can
only document the finding in the audit report. An external auditor is not in a position to
implement controls.
An organization has chosen to open a business office in another country where labor
costs are lower and has hired workers to perform business functions there. This
organization has done what? - ✅ The organization is insourcing - while they may have
opened the office in a foreign country, they have hired locals to do the work as opposed
to contracting with a third party.
An organization has discovered that some of its employees have criminal records. What
is the best course of action for the organization to take? - ✅ The organization should
have background checks performed on all of its existing employees and also begin
instituting background checks of all new-hires. It is not necessarily required to terminate
the employees - their offenses may not warrant termination.
The options for Risk Treatment are: - ✅ Risk Mitigation Risk Avoidance Risk Transfer
Risk Acceptance
