Certified Information Systems Auditor CISA (CISA) — Questions 676–750

The current strategy cannot meet either objective, so the auditor's first action is to communicate the gap and recommend a solution whose capabilities match the requirements. Technologies such as synchronous or asynchronous replication and continuous data protection can deliver a fifteen-minute recovery point and support a two-hour recovery time. Recommending a capability-aligned strategy addresses the root problem rather than adjusting targets or marginally improving an inadequate method.

A DRP derives its recovery priorities and timeframes from BIA output; a three-year-old BIA may no longer reflect current systems or dependencies. Recommending a fresh BIA validates assumptions and updates the DRP, satisfying the need for an accurate, current recovery baseline.

A pilot conversion limits the impact of potential problems by testing the system in a controlled environment before organization-wide deployment. This enables the project team to identify and resolve issues, refine procedures, and provide targeted training. It reduces the risk of a failed full-scale implementation. This is the primary benefit, as it directly addresses the risk of unforeseen problems affecting the entire organization.

Stratified sampling divides the population into distinct subgroups (strata) and draws samples from each, directly matching the stem's description. Unlike simple random or systematic sampling, it guarantees representation across every subgroup, which suits audit populations with heterogeneous characteristics where each stratum warrants coverage.

In a decentralized IT governance model, business units make independent decisions, which can lead to fragmentation, duplication, and integration challenges. The existence of a common framework and standards is critical to ensure that IT systems and processes remain consistent, secure, and interoperable across the organization. Without such a framework, the organization may face increased costs, data silos, and difficulty in achieving enterprise-wide objectives. Thus, this is the most critical factor for the auditor to evaluate.

A trial migration replicates the full extract, transform and load process against a subset, then reconciles record counts and financial totals against source systems. This detects truncation, duplication and mapping errors before go-live, directly satisfying the accuracy and completeness objective.

Waterfall permits change only through formal revision of affected baselines. Updating the requirements and reworking the design keeps subsequent build and test phases aligned with what the business now needs, rather than continuing against obsolete specifications that would guarantee rework later.

The auditor should first validate the design and operating effectiveness of the implemented control, since management's assertion alone is insufficient evidence. Only after testing can the auditor assess whether residual risk has actually been reduced to an acceptable level. Updating the risk register is a management responsibility, and reporting to the audit committee is premature without verification.

Without tabletop exercises, staff never rehearse incident roles, so during a real event they may duplicate effort, miss escalation steps or fail to contain the breach promptly. This directly addresses the stem's two-year gap in exercising, leaving role familiarity untested.

Routine maintenance generates predictable, legitimate database activity that otherwise triggers alerts. Excluding these known operations removes noise at the source, directly reducing false positives without weakening detection of genuinely anomalous behaviour, which is the tuning goal the stem specifies.

A differential backup copies all data modified since the last full backup, accumulating changes across successive runs. This directly satisfies the stem's constraint of capturing only post-full-backup changes, unlike incremental backups, which capture only changes since the previous backup of any type. Restoration therefore requires just the last full backup plus the latest differential.

Continuous monitoring evaluates controls at frequent intervals against live data, so deviations are flagged as they emerge rather than at the next scheduled audit. This delivers timely detection of control deficiencies, directly satisfying the stem's demand for the most significant benefit over traditional periodic audits.

Incomplete user acceptance testing coverage means untested payroll scenarios, such as overtime, deductions or tax bands, may fail silently in production. This directly undermines the control evidence that the system meets requirements, so the auditor should be most concerned.

Transaction log backups every 15 minutes satisfy the 15-minute RPO, while weekly fulls plus log replay meet the 2-hour RTO. This combination minimises storage costs compared with frequent full or differential backups of a 2 TB database.

Unauthorised encryption or tunnelling protocols conceal payload contents from inspection appliances, letting attackers move data past DLP and firewall controls. Legitimate services rarely introduce new tunnels, so their sudden appearance signals possible exfiltration rather than normal egress traffic.

Detailed incident logging is essential for problem management because it enables the identification of patterns and recurring incidents. Without adequate data, root cause analysis cannot be performed effectively. This control ensures that problems are detected proactively rather than reactively, reducing downtime and improving service quality.

Keeping the legacy system read-only provides a reference for reconciliation, but without a formal reconciliation, differences between legacy and new balances may go unnoticed. Once the legacy system is retired, the source data needed to investigate and correct those discrepancies may no longer be available. This creates a lasting risk of inaccurate financial or operational reporting, making it the most significant concern.

External auditors sit outside the organisation's reporting line, so they owe no employment allegiance to management and face no promotion or remuneration pressure from the audited entity. This structural separation from the chain of command directly satisfies the stem's independence constraint, unlike internal auditors who remain employees subject to management authority.

A critical exploitable vulnerability in a web-facing application represents an immediate risk of data compromise. The auditor should recommend urgent remediation or mitigation, such as applying a patch, input validation, or a web application firewall rule, and then validate that the fix works. Addressing the exposure takes precedence over documentation and longer-term process improvements.

A work instruction sits at the lowest level of the policy hierarchy, beneath policies, standards and procedures, and gives step-by-step operational detail for a single task. Resetting a user password is exactly that granular, task-specific level of guidance.

Total cost of ownership captures acquisition plus recurring maintenance across the system's expected life, exposing Vendor A's higher annual fees against Vendor B's bundled three years. Comparing upfront price alone would mislead the auditor, since the stem deliberately trades initial cost against ongoing maintenance.

A right-to-audit clause contractually grants the organisation and its auditors access to the vendor's records, controls and facilities, enabling independent verification of SLA response times. Without it, performance monitoring relies solely on vendor self-reporting, which cannot substantiate compliance claims during audit.

Re-performance involves the auditor independently executing the control procedure and comparing the result with the original, producing evidence generated directly by the auditor rather than the auditee. This self-generated evidence satisfies the stem's demand for the highest assurance, outranking inspection, observation and inquiry, which rely on entity personnel or documentation.

Prioritizing projects based on personal preferences rather than strategic alignment means IT investments may not support the organization's goals. This can result in resources being allocated to low-value projects while critical strategic initiatives are delayed or unfunded. The most significant risk is the misalignment of IT with business strategy, which undermines the value IT delivers and can lead to competitive disadvantage.

Locking out any user after three failed attempts and requiring security staff to re-enroll means an attacker or a clumsy user can repeatedly trigger lockouts, denying access to legitimate staff and consuming administrative effort. The re-enrollment requirement also depends on staff availability, so the process itself becomes an availability and operational risk that outweighs the tuning concerns in this scenario.

Custom ETL is the only viable route because the legacy formats are incompatible with direct migration. Proceeding after thorough testing and validation ensures transformed data is complete and accurate before loading, addressing the incompatibility while managing the risk inherent in bespoke extraction, transformation and load logic.

A significant unexplained variance requires investigation before any conclusion is drawn, since analytical procedures identify anomalies rather than their causes. The auditor must obtain corroborating evidence, such as management explanations, supporting documentation or transaction testing, to determine whether the increase reflects error, fraud or legitimate business change.

A mantrap uses two interlocking doors so only one opens at a time, physically preventing a second person from following an authorised entrant through. This directly defeats tailgating, unlike badges, cameras or turnstiles, which detect or deter but do not physically stop it.

The bucket policy grants read permission to a wildcard principal, meaning any unauthenticated internet user can list and download objects. Public read access exposes the data regardless of other settings, making it the primary concern.

Recording the fault in the known error database with a documented workaround lets the service desk resolve recurrences quickly while the permanent fix is developed. This satisfies the stem's constraint that the root cause is known but no permanent fix yet exists.

Statistical attribute sampling quantifies the exception rate against a defined confidence level and tolerable deviation rate, letting the auditor conclude on the 5,000-item population with measurable precision. Judgemental or block methods cannot support the stated 95% confidence and 2% tolerable error.

A differential backup copies every change since the last full backup, accumulating successive modifications regardless of intervening incremental runs. This cumulative approach means only the latest full plus one differential are needed for restore, reducing restore time compared with incremental chains.

Analysing historical utilisation trends reveals growth patterns and seasonal peaks, allowing capacity to be provisioned before thresholds are breached. Threshold alerts are reactive, firing only once consumption is already excessive, whereas trend analysis supports genuine proactive forecasting and planning.

The auditor's responsibility is to assess whether the implemented control reduces risk to an acceptable level, regardless of whether it matches the original recommendation. If the compensating control adequately mitigates the risk and residual risk falls within the risk appetite, the finding can be closed. This reflects the principle that management owns risk response while the auditor provides objective assurance on the outcome.

Approving IT project budgets and priorities is a primary steering committee duty, since the committee allocates resources and sequences projects to match business objectives. This governance decision keeps investment aligned with strategy rather than departmental preference.

A PMO establishes standardised project governance, oversight and reporting, directly addressing the unclear requirements, scope creep and high-level-only reviews causing overruns. It satisfies the need for project-level governance discipline that the existing framework lacks, rather than merely refining committee structure.

Random sampling gives every transaction in the 1,000-item population an equal, non-zero chance of selection, which the random number generator enforces. This satisfies the stem's requirement for a statistically valid, unbiased sample, unlike haphazard or judgmental methods, and supports extrapolating the 50-transaction results to the full population.

The Evaluate, Direct and Monitor domain covers the governing body's own responsibilities, including evaluating options, directing the entity and monitoring performance. It is the governance objective describing board-level oversight of IT, distinct from the management objectives.

The planning phase establishes the audit's foundation by assessing inherent and control risks, then using that risk assessment to define scope, objectives, criteria and resource allocation, ensuring fieldwork concentrates effort on the areas of greatest significance to the organisation.

Classification assigns sensitivity labels that directly drive which access controls and protection mechanisms apply, satisfying the stem's requirement to identify primary objectives. By mapping data sensitivity to handling rules, it ensures controls such as encryption and permissions match the data's value and risk, rather than being applied uniformly.

The organization's DRP depends on the cloud provider's recovery capabilities, but the SLA does not define RTO/RPO. Without contractual guarantees, the organization cannot ensure that its own RTO/RPO will be met. The auditor should first recommend renegotiating the contract to include these critical metrics, as they are foundational to the DRP.

The most persuasive evidence about whether backups can actually be restored is a restoration test. Performing or observing a test allows the auditor to verify that the backup media are readable, that the recovery procedures work, and that recovery time objectives are realistic. This direct evidence supports a reliable conclusion about the control's operating effectiveness, which is exactly what the auditor needs before deciding whether a finding is warranted.

Without a BIA, the organisation cannot determine maximum tolerable downtime or derive recovery time objectives for critical systems. That gap leaves recovery priorities and continuity requirements undefined, making uncertainty over RTOs the most significant risk identified.

End-of-life operating systems no longer receive vendor security patches, so known vulnerabilities remain exploitable indefinitely. This directly increases the likelihood of security breaches through unpatched flaws, satisfying the stem's request for the risk most directly associated with running unpatched EOL servers.

Level 1 in COBIT 2019 is characterized by ad hoc processes, lack of documentation, and reliance on individual efforts. The scenario describes exactly this: no formal processes and success dependent on heroics. This is the lowest maturity level, indicating that governance is unstructured and unpredictable.

Audit rights grant the organisation contractual authority to inspect vendor controls, logs and processes, directly satisfying the stem's requirement to monitor vendor security. Without this clause, assurance relies on vendor self-reporting, which is insufficient for a critical cloud ERP system.

Shared privileged accounts let multiple administrators act under one identity, so audit logs cannot attribute a specific change to a named person. This directly satisfies the stem's condition: the exhibit shows activity that cannot be traced to an individual, defeating non-repudiation and least-privilege monitoring over privileged actions.

Dependency management prevents a job from starting until its prerequisite completes successfully. Its absence let the batch job run against unmet dependencies and fail silently, which is the root weakness; alerting alone would only report the symptom after the scheduling logic had already misfired.

A missing file error during backup typically means the source file was moved or deleted mid-window, so the backup agent could no longer read it. This differs from media failure, which reports write or read errors on the target, and from permission changes, which produce access-denied messages.

Restricting tabletop scenarios to malware outbreaks leaves the IR plan untested against other plausible incidents, such as insider misuse, denial of service or data breach. The plan's coverage of relevant incident types therefore remains unverified.

Reconciliation of record counts and key field sums verifies completeness and accuracy by comparing source and target totals. This detective control directly confirms that no records were lost, duplicated or corrupted during conversion, satisfying the data integrity objective.

Without central oversight, regional units may independently procure and manage IT resources, leading to redundant systems, duplicated efforts, and lost opportunities for standardization and cost savings. This fragmentation is a classic risk of uncoordinated decentralization. The corporate IT strategy is not enforced, so there is no mechanism to align regional decisions with enterprise goals, making duplication and inefficiency the most likely outcome.

Without proactive problem management, the organization reacts only to major incidents, leaving chronic issues unresolved. Recurring incidents will persist, consuming resources and potentially causing service disruptions. The auditor should highlight this as the primary consequence because problem management aims to prevent incidents by addressing root causes. The lack of trend analysis means minor incidents that collectively indicate a larger problem are ignored, leading to a cycle of repeated failures.

ISO/IEC 38500 defines six principles for IT governance, one of which is "Strategy," requiring that IT plans align with and support the organisation’s current and future business objectives. This satisfies the stem’s constraint of identifying a governance principle, as distinct from frameworks like COBIT or ITIL that focus on management processes or service delivery.

A realistic schedule depends on a complete WBS that captures all deliverables and a Gantt chart that accurately models task dependencies and resource constraints. Without this, the schedule may be optimistic. The auditor should verify that the WBS is comprehensive and that the Gantt chart reflects logical sequencing and resource calendars, ensuring the timeline is achievable.

A walkthrough is itself the audit procedure being executed; the auditor traces transactions through the accounts payable process to confirm controls operate as described. This satisfies the stem directly, as the procedure's name matches the activity performed.

Cleaning only at extraction leaves errors introduced or exposed during transformation and loading unchecked, so corrupt records reach the target ERP without a validation gate. The absence of load-stage cleansing removes the final detection point, letting integrity defects persist silently in production data.

Role-based access controls assign permissions by job function rather than individual, preventing any single user from holding conflicting duties such as creating a vendor and approving its payment. This directly addresses the segregation of duties conflicts the ERP implementation raises.

Contractual reuse rights let the vendor redeploy code built for this organisation into other clients' projects, eroding exclusive ownership and potentially exposing proprietary logic or data-handling design. The primary concern is therefore loss of control over intellectual property, not delivery timelines or code quality.

COTS systems deliver value through standardised, vendor-supported functionality; heavy customisation breaks upgrade paths, voids support, and inflates cost. Aligning business processes to the product with minimal modification preserves those benefits, making it the most important factor during implementation.

Testing the compensating controls establishes whether they actually reduce the risk arising from the missing control, which is the evidence needed before concluding on control adequacy. Walkthroughs alone only confirm design; substantive testing of the compensating control's operating effectiveness satisfies the auditor's obligation to assess residual risk.

The framework's credibility depends on whether the delegated authority is actually enforced. Exceptions are the primary leak path: if they are undocumented, open-ended, or approved at too low a level, the architecture board's decision rights become nominal. Verifying that exceptions are documented, time-bound, and approved commensurate with risk directly tests whether the governance design operates as intended in practice.

Core feature.

With daily incremental backups, the maximum data loss is up to 24 hours of transactions if a failure occurs just before the next backup. The RPO of 4 hours requires backups at least every 4 hours, such as transaction log shipping or more frequent incrementals. This is the most critical finding because it directly violates the recovery requirement.

An SLA translates business requirements into measurable key performance indicators, giving the company an enforceable basis to monitor the outsourcer's delivery. Without defined metrics and remedies, governance over the arrangement lacks objective evidence of compliance.

User satisfaction survey results directly capture how customers perceive IT service quality, matching the balanced scorecard's customer perspective. Other metrics, such as incident resolution or budget variance, reflect internal process or financial perspectives rather than customer outcomes.

A post-implementation review compares delivered functionality against the original business case and user requirements, confirming the system actually delivers intended benefits. This satisfies the stem's objective of verifying that user requirements were met after go-live.

Implementation is a recognised SDLC phase in which the designed system is coded, configured and deployed into the production environment. It follows design and precedes testing and maintenance, forming the build stage of the lifecycle.

Data residency controls restrict where EU personal data is stored and processed, preventing replication of the AD forest's personal data to non-EU data centres. This keeps processing within a jurisdiction offering GDPR-equivalent protection, directly addressing the DPO's concern about inadvertent transfer to inadequately protected countries.

Unsupported software no longer receives security patches, so known vulnerabilities remain exploitable, undermining controls required by regulations such as GDPR, PCI DSS or HIPAA. This exposes the organisation to fines, sanctions and audit findings, satisfying the stem's regulatory non-compliance risk.

Threat modeling systematically identifies potential threats, attack vectors and required mitigations against the proposed design. Conducted during the design phase, it satisfies the requirement to integrate security before coding begins, when architectural changes remain inexpensive compared with remediation after implementation.

99.9% uptime permits 0.1% downtime; in a 30-day month (43,200 minutes) that equals about 43.2 minutes. The 45-minute outage exceeds this allowance, so the SLA was breached, confirming the service did not meet its monthly commitment.

The two-day UAT by hand-picked power users missed a country-specific statutory requirement, so the control weakness is the UAT design itself. Recommending a formal process covering all regions with a statutory-requirement checklist addresses the root cause and prevents recurrence in later phased rollouts.

The assessed level of control risk is low because controls are strong and have been tested. Under the audit risk model, lower control risk allows the auditor to place greater reliance on controls and reduce the extent of substantive procedures. This keeps detection risk at a level that holds overall audit risk within acceptable bounds while avoiding unnecessary testing. High inherent risk is already reflected in the assessment and is managed through this combined approach.

Test transactions submitted through live production systems can be indistinguishable from genuine entries, so the system may post, approve or settle them as real business. This contaminates financial data and could trigger actual payments or obligations, which is the primary risk of this technique.