CCISO Audit Management 5

Question 1

A CISO is preparing an audit report for the board. Which characteristic is most important for the executive summary?

Accepted Answer

Concise risk-ranked findings with business impact and remediation priorities

Answer

Executive summaries should present risk-ranked findings with clear business impact and prioritized recommendations to support board-level decision-making.

Question 2

Which control testing approach is most appropriate when an auditor wants to verify that preventive controls operated effectively throughout the entire audit period?

Accepted Answer

Testing a sample of transactions across the full period

Answer

Testing a sample spread across the entire period provides evidence that controls operated consistently throughout, not just at a single point in time.

Question 3

Under COBIT 2019, which governance objective directly supports the audit management function by ensuring IT-related risks are identified and managed?

Accepted Answer

APO12 — Managed Risk

Answer

APO12 (Managed Risk) in COBIT 2019 governs the identification, assessment, and response to IT-related risks, directly supporting audit management activities.

Question 4

What is the primary distinction between a Type I and Type II SOC 2 report?

Accepted Answer

Type I assesses control design at a point in time; Type II assesses design and operating effectiveness over a period

Answer

A SOC 2 Type I report evaluates control design at a specific date, while Type II also tests operating effectiveness over a defined review period (typically 6–12 months).

Question 5

A CISO wants to reduce audit fatigue caused by multiple simultaneous audits from different regulators. Which strategy is most effective?

Accepted Answer

Implement a coordinated audit management program that consolidates evidence collection and aligns audit schedules

Answer

A coordinated audit management program consolidates evidence artifacts and aligns scheduling to reduce redundant requests and minimize disruption to operations.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Audit Management 5