IT Governance 1.0

Question 1

WHAT insurance type provides for a loss arising from fraudulent acts by employees?

Answer 1

Fidelity Coverage

i.e. This type of insurance covers the loss arising from dishonest or fraudulent acts by employees

Question 2

WHAT is an IS auditor’s primary concern when reviewing a business process reengineering (BPR) effort?

Answer 2

That controls are eliminated as part of the streamlining BPR effort.

i.e. A primary risk of BPR is that controls are eliminated as part of the reengineering effort.

Question 3

Who within the organization is responsible for approving an information security policy?

Answer 3

The Board of Directors

Question 4

What does a lack of adequate security controls represent?

Answer 4

Vulnerability

i.e. Lack of adequate security functionality in this context is a vulnerability

Question 5

What type of insurance provides for a loss arising from fraudulent acts by employees?

Answer 5

Fidelity coverage

Question 6

What step should be executed FIRST, when developing a security architecture?

Answer 6

Defining a security policy

i.e. This is the first step to defining a security policy

Question 7

What would ‘best’ support the prioritization of new IT projects?

Answer 7

Investment portfolio analysis

i.e., This will present a clear focus on investment strategy and also provide the rationale for terminating nonperforming IT projects

Question 8

What risk management practice would most likely expose an organization to the greatest amount of compliance risk?

Answer 8

Risk Transfer

i.e., This typically addresses financial risk

Question 9

What would an IS auditor consider ‘most’ important in facilitating compliance with a newly developed IT policy for an organization?

Answer 9

Existing IT mechanisms enabling compliance

Question 10

What is most critical when evaluating the effectiveness of an IT governance implementation?

Answer 10

Determining stakeholder requirements and involvement

Question 11

What is of ‘primary concern’ when performing a review of a business process reengineering (BPR) effort?

Answer 11

Controls are eliminated as part of the streamlining BPR effort

Question 12

What would be an important consideration when reviewing the classification levels of information assets?

Answer 12

Potential loss

i.e., The best basis for asset classification is an understanding of the total losses a business may incur if the asset is compromised