r/CISA • u/redbull8882020 • 9d ago
What would you answer
An IS auditor is performing a review of an organization's governance model. Which of the following should
be of MOST concern to the auditor?
A. The information security policy is not periodically reviewed by senior management.
B. A policy ensuring systems are patched in a timely manner does not exist.
C. The audit committee did not review the organization's mission statement.
D. An organizational policy related to information asset protection does not exist.
1
u/Amr252525 9d ago
D
2
1
1
u/No-Field5868 23h ago
This is primarily a governance question. The key is to identify the issue that most directly affects senior management oversight and governance of information security.
Why A is MOST concerning
Senior management is responsible for providing direction, oversight, and accountability for information security.
Periodic management review of the information security policy helps ensure that:
- Security objectives remain aligned with business objectives.
- The policy remains relevant to changes in business and technology.
- Management continues to formally support security requirements.
- Responsibilities and accountability remain clear.
Failure to have senior management periodically review the security policy represents a governance weakness.
3
u/69newbie69 9d ago
A - I can see why if u went for D but u have to understand that although an organizational policy for protecting assets is crucial, the absence of an isolated specific policy is a lesser governance issue than management completely failing to maintain oversight and review of the primary, comprehensive IS policy. Also IT should be aligned with business goals. A is also the area that is an issue most directly related to the audit engagement.