An external IS auditor is reviewing the continuous monitoring system for a large bank and notes several potential issues. Which of the following would present the GREATEST concern regarding the reliability of the monitoring system?
A.
The monitoring system was configured by IT.
B.
The system results are not regularly reviewed by management.
Page 68 of the manual states: "Continuous auditing should be independent of continuous control or monitoring activities." If the IT department, which is responsible for the systems being monitored, also configures the monitoring system, this could compromise the independence of the monitoring process. This lack of independence can directly impact the reliability of the monitoring system as it might be biased or not as objective.
Without management review, the entire monitoring function becomes ineffective because:
Identified issues would remain unaddressed
The effectiveness of the monitoring cannot be verified
The purpose of having a monitoring system is defeated
This aligns with the CISA Review Manual's emphasis that monitoring must have appropriate management oversight to achieve its objectives. When "reviewing management's control monitoring processes, an IS auditor should ensure that identified control exceptions are remediated and lessons learned are considered for security program enhancement."
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
46080f2
3 days, 22 hours ago46080f2
3 days, 22 hours ago