Audit Management Flashcards

During planning for an assessment of a cloud-hosted system, the CGRC practitioner learns that the cloud service provider (CSP) holds a FedRAMP authorization and offers a customer responsibility matrix. The agency's assessor wants to reuse the CSP's existing assessment results to reduce testing. Which approach BEST aligns with NIST SP 800-37 and SP 800-53A assessment practice?

Answer: Reuse the CSP's assessment evidence for inherited and provider-implemented controls where it is current and appropriate, and independently assess the customer-responsible and hybrid controls

Assessment results may be reused when they are relevant, current, and obtained under suitable conditions, which is common for inherited controls. The customer remains responsible for assessing system-specific and hybrid controls, and the authorizing official still makes the risk decision. Accepting the whole package or discarding it are both extremes, and the assessor does not need to be the same organization.

An independent assessor finds that a control's evidence was gathered through interviews only, and the control protects high-impact functionality. The assessment plan called for the 'examine, interview, and test' methods at a depth of 'focused.' Which action BEST addresses the gap in assessment rigor?

Answer: Supplement with examination of artifacts and technical testing so the evidence meets the planned methods and the required depth and coverage

SP 800-53A defines assessment methods (examine, interview, test) and attributes of depth and coverage. Interview-only evidence for a high-impact control does not satisfy the planned methods or the rigor the assessment plan requires, so the assessor must obtain artifacts and test results. Declaring a control not applicable simply because testing is difficult is improper.

A continuous monitoring program has pushed a control from annual to quarterly assessment because of a rising rate of related incidents. What is the MOST appropriate basis for adjusting monitoring frequency according to NIST SP 800-137?

Answer: The volatility of the control, the system's impact level, threat information, and the risk tolerance of the organization

SP 800-137 states that monitoring frequency should reflect control volatility, system categorization and impact, threat and vulnerability information, assessment findings, and organizational risk tolerance. Cost and convenience are practical constraints but not the primary basis, and the change should be established within the monitoring strategy, not retroactively announced.

An auditor reviewing a POA&M notices that several items were closed by the system owner, citing 'risk accepted,' without any documented approval from the authorizing official. What is the MOST significant issue with this practice?

Answer: Risk acceptance for residual risk is a decision reserved for the authorizing official, so the closures lack proper authority and the weaknesses remain unresolved in the risk posture

The authorizing official, or a designated representative, determines whether residual risk is acceptable. A system owner cannot unilaterally close POA&M items by declaring risk accepted, so those weaknesses are still open and the system's risk posture is misrepresented.

During a combined audit, an auditor identifies that a system's audit logs are reviewed by the same administrator who has privileged access to modify those logs. The organization states that the administrator is highly trusted. Which conclusion is MOST defensible?

Answer: This is a separation-of-duties and audit-protection weakness, and independent review or tamper-evident log protection is needed to restore the control's effectiveness

Allowing a privileged user to both review and modify audit records undermines separation of duties and the integrity of audit information. Trust is not a substitute for control design. Compensating measures such as independent review, centralized write-once logging, or integrity checks are needed.

A CGRC practitioner prepares for a significant change to an authorized system, and the change falls outside the scope of what the authorizing official previously evaluated. After a security impact analysis, what is the MOST appropriate next step?

Answer: Update the risk assessment, security plan, and assessment scope as needed, then reassess the affected controls and engage the authorizing official on whether reauthorization is required

A change that is significant enough to affect the risk posture warrants updating the related documentation, reassessing the affected controls, and consulting the authorizing official. The AO decides whether the change requires reauthorization or can be handled within ongoing authorization. Deferring reporting or skipping documentation leaves the AO uninformed.