Security Auditing & Compliance Standards Flashcards

Which control framework specifically addresses security requirements for US federal information systems and is mandated by law?

Answer: FISMA / NIST SP 800-53

FISMA (Federal Information Security Modernization Act) mandates that federal agencies implement security controls defined in NIST SP 800-53.

An organization receives an audit finding that its change management process lacks formal rollback procedures. This finding is BEST addressed by:

Answer: Updating change management policy and procedures to include rollback steps and testing

The finding identifies a process gap; the correct remediation is to update procedures to include rollback planning and test those procedures.

Which term describes the process where an organization independently verifies that its own controls are operating as intended before an external audit?

Answer: Internal audit / self-assessment

Internal audits or self-assessments allow organizations to proactively identify gaps and remediate them before external auditors review the same controls.

Under SOX Section 404, management and external auditors must report on the effectiveness of:

Answer: Internal controls over financial reporting

SOX Section 404 requires management to assess and report on internal controls over financial reporting (ICFR), with external auditor attestation.

Which evidence collection method is considered MOST reliable in an audit because it is obtained directly by the auditor without intermediary involvement?

Answer: Direct observation by the auditor

Direct observation is the most reliable audit evidence because the auditor personally witnesses the control in operation, eliminating reliance on auditee-supplied information.

A company operating in the EU and US must align its data transfer practices with which mechanism that governs cross-border personal data transfers post-Privacy Shield?

Answer: EU-US Data Privacy Framework

The EU-US Data Privacy Framework (2023) replaced Privacy Shield and provides the legal mechanism for transatlantic personal data transfers under GDPR.

During an audit, the auditor reviews system-generated reports rather than paper records. This approach is called:

Answer: Computer-assisted audit techniques (CAATs)

Computer-Assisted Audit Techniques (CAATs) use software tools to analyze large volumes of electronic data, improving audit efficiency and coverage.