The Certified Information Systems Auditor (CISA)

 Information security policies and procedures are the foundation of an organization’s information security program. They define the roles, responsibilities, rules, and standards for protecting information assets from unauthorized access, use, disclosure, modification, or destruction. The most important factor when developing information security policies and procedures is to align them with an information security framework that provides a comprehensive and consistent approach to managing information security risks. An information security framework can also help ensure compliance with relevant regulations, inclusion of mission and objectives, and consultation with security staff. However, these factors are secondary to alignment with an information security framework. References: CISA Certification | Certified Information Systems Auditor | ISACA, CISA Review Manual (Digital Version)

A governing body monitors IT performance most effectively when IT performance metrics are aligned with business goals. ISACA’s COBIT-based governance guidance consistently emphasizes that metrics should help leadership and governing bodies monitor the achievement of enterprise business goals and related IT goals. Metrics are useful for governance only when they are connected to what the enterprise is trying to achieve.

Option D is correct because a governing body is responsible for oversight at the strategic level. Strategic oversight depends on understanding whether IT is supporting business objectives, not just whether technical measures are being collected. ISACA states that metrics help management monitor achievements of business-related and IT-related goals.

Option A is useful at an operational or service management level, but it is narrower than business alignment. Service delivery objectives matter, yet the governing body’s concern is broader enterprise value and strategic alignment.

Option B is not the best answer because manufacturer recommendations may help establish technical asset baselines, but they do not ensure metrics support governance needs or enterprise performance oversight.

Option C is attractive because automated, quantitative data improves reliability and efficiency, but automation alone does not guarantee the metrics are the right ones. Governance requires relevant metrics tied to business outcomes, not just easily measured data.

Therefore, D is the best answer because proper alignment between business goals and IT performance metrics is what most enables a governing body to monitor IT performance meaningfully.

References (Official ISACA):

ISACA Journal, Performance Measurement Metrics for IT Governance — metrics help management monitor achievement of business-related and IT-related goals.

ISACA Journal, How to Construct a Governance System From the Board Level to the Code Level — enterprise goals are cascaded into IT alignment goals, metrics and results.

ISACA, Charting the Course of IT Governance — performance measurement involves defining and monitoring KPIs for IT and communicating performance to stakeholders.

ISACA, Seven Key Features, Lessons and Tips From a COBIT Journey of 27 Years — COBIT uses goals, metrics and capabilities at enterprise and IT levels.

A comprehensive asset inventory is the most important factor for the successful establishment of a security vulnerability management program. A security vulnerability management program is a systematic process of identifying, assessing, prioritizing, and remediating vulnerabilities in the organization’s IT environment1. A comprehensive asset inventory is a complete and accurate record of all the hardware, software, and network components that the organization owns or uses2. A comprehensive asset inventory helps the organization to:

Know what assets are in scope for vulnerability scanning and assessment3.

Identify the vulnerabilities that affect each asset and their severity level4.

Prioritize the remediation of vulnerabilities based on the criticality and value of each asset.

Track the status and progress of vulnerability remediation for each asset.

Measure the effectiveness and maturity of the vulnerability management program.

A robust tabletop exercise plan is a simulated scenario that tests the organization’s preparedness and response capabilities for a potential cyberattack or incident. A tabletop exercise plan is useful for validating and improving the organization’s incident response plan, but it is not essential for establishing a security vulnerability management program.

A tested incident response plan is a documented process that defines the roles, responsibilities, and actions of the organization’s personnel in the event of a cyberattack or incident. A tested incident response plan is important for minimizing the impact and restoring normal operations after a security breach, but it is not critical for establishing a security vulnerability management program.

An approved patching policy is a set of rules and guidelines that governs how the organization applies patches and updates to its IT systems and applications. An approved patching policy is a key component of the remediation phase of the vulnerability management program, but it is not sufficient for establishing a security vulnerability management program.

The programmer having access to the production programs is a control weakness that would have contributed most to the problem of unauthorized changes to key fields in a payroll system report. This is because it violates the principle of segregation of duties, which requires that different individuals or groups perform different functions related to system development, testing, implementation, and operation. Allowing programmers to access production programs increases the risk of errors, fraud, or malicious actions that may compromise the integrity, availability, or confidentiality of the system or its data. The other options are not as significant as having access to production programs, as they relate to other aspects of system development or maintenance, such as user involvement in testing (which affects user satisfaction and acceptance), user requirements documentation (which affects system functionalityand quality), and payroll files control (which affects data security and accuracy). References: CISA Review Manual (Digital Version), Domain 3: Information Systems Acquisition, Development and Implementation, Section 3.2 Project Management Practices

Comprehensive and Detailed Explanation:

A tabletop exercise is the most cost-effective method to test the BCP because it simulates scenarios and walks through responses without disrupting operations.

Stress test (A): More resource-intensive and may disrupt services.

Full operational test (C): Provides the highest assurance but is costly and disruptive.

Post-implementation review (D): Evaluates after actual incidents, not proactive.

???? ISACA Reference: CISA Review Manual 27th Edition, Domain 2 (IT Operations and Business Resilience), section on BCP testing approaches.

Segregation of duties (SoD) is a key internal control that aims to prevent fraud and errors by ensuring that no single individual can perform incompatible or conflicting tasks within a business process. SoD reduces the risk of unauthorized or improper transactions, manipulation of data, or misappropriation of assets.

In the accounts payable department, SoD involves separating the following functions: invoice processing, payment authorization, payment execution, and reconciliation. For example, the person who approves an invoice should not be the same person who issues the payment or reconciles the bank statement.

One of the best ways to ensure appropriate SoD within the accounts payable department is to restrict program functionality according to user security profiles. This means that each user of the accounts payable system should have a unique login and password, and should only have access to the functions that are relevant to their role and responsibilities. For instance, an invoice processor should not be able to approve payments or modify vendor records. This way, the system can enforce SoD and prevent unauthorized or fraudulent activities.

The other options are not as effective as restricting program functionality according to user security profiles. Restricting access to update programs to accounts payable staff only is a general access control measure, but it does not address the SoD issue within the accounts payable department. Including the creator’s user ID as a field in every transaction record created is a useful audit trail feature, but it does not prevent users from performing incompatible functions. Ensuring that audit trails exist for transactions is a detective control that can help identify and investigate any irregularities, but it does not prevent them from occurring in the first place.

For an organization that has plans to implement web-based trading, it would be most important for an IS auditor to verify that the organization’s information security plan includes security requirements for the new application. Security requirements are statements that define what security features and functions are needed to protect the confidentiality, integrity, and availability of the web-based trading application and its data. Security requirements should be identified and documented during the planning phase of the application development life cycle, before any design or coding activities take place. Attributes for system passwords, security training prior to implementation, and firewall configuration for the web server are also important aspects of information security, but they are not as essential as security requirements for ensuring that the web-based trading application meets its security objectives.

System-generated data is generally more reliable than interview evidence, which is subjective and prone to bias. Audit standards emphasize evidence that is sufficient and appropriate, where appropriateness relates to relevance and reliability.

References (ISACA): ISACA Audit Standards – Evidence Collection.

The mitigating factor that would most significantly minimize the impact of not renewing IT risk acceptances in a timely manner is having documented compensating controls over the business processes. Compensating controls are alternative controls that reduce or eliminate the risk when the primary control is not feasible or cost-effective. The other factors, such as previous approval by senior management, unchanged business environment, and small percentage of issues, do not mitigate the risk as effectively as compensating controls. References: ISACA CISA Review Manual 27th Edition Chapter 1