CCISO Audit Management 4

Question 1

When an external auditor identifies a material weakness in internal controls, what must a publicly traded company in the US do under SOX Section 404?

Accepted Answer

Disclose the material weakness in its annual report and management's assessment

Answer

SOX Section 404 requires management and external auditors to report on internal control effectiveness, including disclosure of any material weaknesses in the annual report.

Question 2

Which audit evidence type is generally considered most reliable?

Accepted Answer

Evidence obtained directly by the auditor through observation and reperformance

Answer

Evidence obtained directly by the auditor — through observation, inspection, or reperformance — is considered the most reliable because it is not filtered through the auditee.

Question 3

A CISO is conducting a gap analysis between current security controls and ISO 27001 requirements. What audit technique is being applied?

Accepted Answer

Compliance testing

Answer

Comparing existing controls against a standard's requirements is compliance (or conformance) testing, which determines whether controls meet defined criteria.

Question 4

What is the purpose of an audit work paper review by a senior auditor before report issuance?

Accepted Answer

To verify that evidence supports findings and that conclusions are adequately documented

Answer

Senior review of work papers ensures that findings are supported by sufficient evidence and that documentation meets quality standards before the report is issued.

Question 5

Which concept describes the risk that audit procedures will fail to detect a material misstatement that exists?

Accepted Answer

Detection risk

Answer

Detection risk is the risk that the auditor's procedures will not identify a material misstatement or control failure that actually exists.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Audit Management 4