An organization is choosing key performance indicators (KPIs) for its information security management.
Which of the following KPIs would provide stakeholders with the MOST useful information about whether information security risk is being managed?

• A.The number of security incidents during the past quarter
• B.Time from identifying a security threat to implementing a solution
• C.Time from initial reporting of an incident to appropriate escalation
• D.The number of security controls implemented

Comment: *

Name: *

Email: *

Verification: *

Which of the following should be seen as one of the most significant factors considered when determining the frequency of IS audits within your organization?

• A.The cost of risk analysis
• B.The income generated by the business function
• C.Resource allocation strategy
• D.The nature and level of risk
• E.None of the choices.

Comment: *

Name: *

Email: *

Verification: *

Which of the following IT resource management practices is MOST Important for an IS auditor to verify when evaluating third-party outsourcing relationships?

• A.Operational level agreements (OLAs) for departments and projects are monitored
• B.Management regularly meets with the service provider
• C.Service level agreements (SLAs) in external contracts are monitored.
• D.An IT strategy for dividing activities among multiple suppliers is in place.

Comment: *

Name: *

Email: *

Verification: *

During a follow-up audit, an IS auditor finds that some critical recommendations have the IS auditor's BEST course of action?

• A.Require the auditee to address the recommendations in full.
• B.Adjust the annual risk assessment accordingly.
• C.Evaluate senior management's acceptance of the risk.
• D.Update the audit program based on management's acceptance of risk.

Comment: *

Name: *

Email: *

Verification: *

While conducting an audit of a service provider, an IS auditor observes that the service provider has
outsourced a part of the work to another provider. Since the work involves confidential information, the IS
auditor's PRIMARY concern should be that the:

• A.requirement for protecting confidentiality of information could be compromised.
• B.contract may be terminated because prior permission from the outsourcer was not obtained.
• C.other service provider to whom work has been outsourced is not subject to audit.
• D.outsourcer will approach the other service provider directly for further work.

Comment: *

Name: *

Email: *

Verification: *