Audit Management Flashcards

During an assessment of a system that was authorized by the AO under an ATO with a continuous monitoring strategy, an assessor finds that a control's evidence was produced by the same engineer who implemented the control and now maintains it. The organization's SCA is a separate internal team reporting to the CISO. The system is categorized High impact. Which approach BEST preserves the integrity of the assessment under NIST SP 800-53A / RMF principles?

Answer: Require the assessor to independently examine, interview, and test the control rather than rely on implementer-generated artifacts alone, and consider an independent assessor with greater independence for High-impact systems

SP 800-53A requires assessors to obtain sufficient evidence via examine, interview, and test methods; implementer-produced artifacts can be used as inputs but must be corroborated. For High-impact systems, a greater degree of assessor independence (e.g., independent of the CISO's chain or an external party) is expected so the AO can have confidence in results. Team-level separation alone does not cure a self-review threat, and implementer evidence is not automatically inadmissible.

An assessor tests a control enhancement and finds it 'Other Than Satisfied' because a compensating control, not the one specified, provides equivalent protection. The compensating control was never documented in the SSP or approved by the AO. What is the MOST appropriate handling during audit reporting?

Answer: Mark the control Other Than Satisfied, record the finding with the undocumented compensating control as context, and recommend the system owner formally document it in the SSP and obtain AO acceptance of the risk or equivalency

Compensating controls must be justified, documented in the SSP, and accepted by the AO as part of tailoring. An assessor assesses against the documented control baseline and does not unilaterally accept equivalency; the finding is reported in the SAR with context and recommendations so the AO can make a risk-based decision.

During sampling for an audit of access-recertification, an auditor selects a statistical sample and finds 2 exceptions in 60 items, exceeding the tolerable deviation rate set at 2 exceptions for the sample size. Which conclusion BEST follows from audit sampling principles?

Answer: The auditor should evaluate whether exceptions equal or exceed the tolerable deviation in context, consider expanding the sample or testing compensating controls, and may conclude the control is not operating effectively if the upper deviation limit exceeds the tolerable rate

Sampling risk requires comparing the upper deviation limit (the sample rate adjusted for sampling risk) with the tolerable rate. Exceptions at the threshold typically imply the upper limit exceeds tolerable, so the auditor should expand testing, look for compensating controls, or conclude the control is ineffective. Re-sampling until clean (sample shopping) is improper.

An organization is moving a system from periodic reauthorization to ongoing authorization. Which element is MOST critical for the AO to rely on continuous monitoring results in lieu of a triennial reassessment?

Answer: A documented ISCM strategy with defined metrics, assessment frequencies tied to control volatility and risk, and automated data feeds that provide timely and reliable inputs to the AO's risk determination

Ongoing authorization depends on a mature ISCM program (SP 800-137) with defined metrics, risk-based assessment frequencies, and trustworthy data sufficient for the AO to maintain an up-to-date understanding of risk. It does not eliminate assessment reports or require uniform monthly testing.

An auditor discovers that audit logs for a High-impact system are retained for the required period, but the logging configuration was changed three months ago by a privileged administrator to exclude authentication failures, with no change record. Which finding classification and response is MOST appropriate?

Answer: A significant deficiency affecting multiple controls (audit event selection, configuration change control, separation of duties/privileged account monitoring), requiring root-cause analysis, evaluation of log completeness for the period, and potential incident review

Suppressing authentication-failure events without a change record impacts several controls: audit event definition, configuration change control, and monitoring of privileged activity. The gap in log completeness also undermines detection capability and may mask malicious activity, so root-cause analysis and incident review are warranted. Retention alone does not address the integrity or completeness of what was logged.