Exam CISA topic 1 question 822 discussion

B. Confirm there are procedures in place to ensure organizational agreements address legal requirements In highly regulated industries like banking, ensuring that organizational agreements address legal requirements is crucial. By confirming that procedures are in place to address these legal obligations, an IS auditor ensures that the organization has a structured approach to compliance. This step is vital to ascertain that all legal and regulatory requirements are being considered in the organization’s operations.

D. Identify industry-specific requirements that apply to the organization. Identifying industry-specific requirements is a fundamental step in assessing compliance because it helps the IS auditor understand the specific regulatory and compliance standards that are relevant to the organization's operations in the banking industry. Once these requirements are identified, the auditor can proceed to evaluate how well the organization adheres to them and whether it has established the necessary procedures and documentation to ensure compliance. The other options (A, B, and C) may be relevant to the assessment process, but they typically come after identifying the industry-specific requirements, as they involve evaluating adherence to those requirements and ensuring that organizational procedures align with legal and industry benchmarks.