IT Compliance and Assurance Flashcards

In IT governance, 'compliance' PRIMARILY refers to:

Answer: Adherence to laws, regulations, standards, and internal policies applicable to IT

IT compliance means conforming to the external regulatory requirements and internal policies that govern how IT systems and data must be managed.

Which US regulation MOST directly requires IT governance controls over financial reporting systems?

Answer: Sarbanes-Oxley Act (SOX)

SOX Section 404 requires organizations to establish and certify internal controls over financial reporting, including IT systems that support those reports.

An IT compliance audit PRIMARILY evaluates whether:

Answer: IT controls and practices conform to required standards, regulations, or policies

An IT compliance audit assesses whether the organization's IT controls and practices conform to the applicable legal, regulatory, and policy requirements.

The concept of 'IT assurance' BEST refers to:

Answer: Independent validation that IT controls are operating effectively and reliably

IT assurance is an independent evaluation that gives stakeholders confidence that IT controls are operating as intended and are reliable.

Which standard is MOST commonly used as a framework for IT controls assurance in US organizations?

Answer: COBIT (Control Objectives for Information and Related Technologies)

COBIT is the primary globally recognized framework for IT governance and control objectives, widely used for assurance and compliance assessments in US organizations.

A 'control deficiency' identified during an IT audit MOST requires:

Answer: A documented remediation plan with assigned ownership and target dates

A control deficiency requires a remediation plan with clear ownership and deadlines so the gap in controls is systematically closed.