CISA Practice Question: Information Systems Operations and Business Resilience
An organization outsources its data center operations to a third-party vendor. The contract includes a right-to-audit clause. During a scheduled audit, the vendor refuses to provide access to logs from a subcontractor managing network security. What is the IS auditor's best course of action?
⚠ Common exam trap
The trap here is that candidates may prematurely choose termination (Option D) or accept the refusal (Option B) without recognizing that the right-to-audit clause is a contractual lever that should be enforced through escalation before considering contract termination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate the issue to the vendor management team to enforce the contractual right.
The right-to-audit clause in the contract gives the organization legal authority to examine all relevant records, including those from subcontractors. Escalating to the vendor management team is the correct first step because they can enforce the contractual obligation without prematurely escalating to termination. This preserves the business relationship while asserting the organization's audit rights over the entire outsourced environment, including subcontracted network security operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Escalate the issue to the vendor management team to enforce the contractual right.
Why this is correct
The vendor management team can use contractual remedies to obtain access.
- ✗
Accept the vendor's refusal to avoid conflict.
Why it's wrong here
Acceptance would leave a gap in audit coverage.
- ✗
Request the vendor to include a clause in its subcontractor agreement allowing audits.
Why it's wrong here
This should have been done during contract negotiation, not during an audit.
- ✗
Report the refusal to senior management and recommend terminating the contract.
Why it's wrong here
Termination is too drastic without first attempting to enforce the clause.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.