- (Exam Topic 4)
An IS department is evaluated monthly on its cost-revenue ratio user satisfaction rate, and computer downtime This is BEST zed as an application of.

1. A. risk framework
2. B. balanced scorecard
3. C. value chain analysis
4. D. control self-assessment (CSA)

Correct Answer: B

- (Exam Topic 1)
Which of the following data would be used when performing a business impact analysis (BIA)?

1. A. Projected impact of current business on future business
2. B. Cost-benefit analysis of running the current business
3. C. Cost of regulatory compliance
4. D. Expected costs for recovering the business

Correct Answer: A

- (Exam Topic 2)
Which of the following activities would allow an IS auditor to maintain independence while facilitating a control sell-assessment (CSA)?

1. A. Implementing the remediation plan
2. B. Partially completing the CSA
3. C. Developing the remediation plan
4. D. Developing the CSA questionnaire

Correct Answer: D

- (Exam Topic 1)
During a disaster recovery audit, an IS auditor finds that a business impact analysis (BIA) has not been performed. The auditor should FIRST

1. A. perform a business impact analysis (BIA).
2. B. issue an intermediate report to management.
3. C. evaluate the impact on current disaster recovery capability.
4. D. conduct additional compliance testing.

Correct Answer: C

- (Exam Topic 1)
Prior to a follow-up engagement, an IS auditor learns that management has decided to accept a level of residual risk related to an audit finding without remediation. The IS auditor is concerned about management's decision. Which of the following should be the IS auditor's NEXT course of action?

1. A. Accept management's decision and continue the follow-up.
2. B. Report the issue to IS audit management.
3. C. Report the disagreement to the board.
4. D. Present the issue to executive management.

Correct Answer: B