CISA Protection of Information Assets Practice Question
An organization has implemented a clean desk policy. Which of the following is the BEST audit procedure to verify compliance?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conducting unannounced inspections of workstations
Surprise walkthroughs provide a realistic view of daily compliance, unlike scheduled inspections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reviewing security camera footage of office areas
Why it's wrong here
Camera footage shows only areas within camera coverage and cannot confirm desk contents such as documents inside drawers or under keyboards. It tempts because surveillance is objective and non-intrusive, and it would suit verifying physical perimeter or after-hours access controls instead.
- ✗
Reviewing the policy document and employee acknowledgments
Why it's wrong here
Document review and acknowledgments only evidence that staff signed the policy, not that desks are actually cleared at end of day. It is tempting because policy-and-sign-off checks are cheap and repeatable, and would suit verifying awareness or training completion rather than operational compliance.
- ✗
Interviewing employees about the policy
Why it's wrong here
Interviews reveal awareness of the policy but not actual desk conditions; employees may report compliance inaccurately. It tempts because interviews are quick and inexpensive, and they would be appropriate for assessing policy training or staff understanding rather than verifying physical compliance.
- ✓
Conducting unannounced inspections of workstations
Why this is correct
Unannounced inspections provide direct, first-hand evidence of whether sensitive documents and media are actually secured when staff leave workstations, satisfying the need to verify real compliance rather than assumed adherence. Announced checks or policy reviews only confirm intent, not operational practice.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.