Exam CISA topic 1 question 430 discussion

The greatest concern for an IS auditor when reviewing information security controls would be the absence of mobile device provisions in the information security policy, especially in today’s increasingly mobile and remote work environments. Here’s why: Mobile device risks: Mobile devices, such as smartphones, tablets, and laptops, represent significant security risks because they are more susceptible to being lost, stolen, or hacked. These devices can access sensitive company data and, if not properly secured, can introduce vulnerabilities. Having provisions for managing the security of mobile devices is crucial to maintaining the integrity of an organization’s information security framework. Security control gaps: If the policy does not address mobile devices, it could create a significant gap in the organization's security posture, leaving critical data exposed. This omission could lead to breaches, unauthorized access, or data loss.

While the frequency of reviewing the information security policy (option B) is important for ensuring its relevance and alignment with evolving threats and organizational changes, it is secondary to the fundamental issue of having the policy approved by the appropriate authority (option D).

Answer D it's important for the IS auditor to ensure that the information security policy has been approved by the appropriate senior management authority, whoever that may be in the organization.

i woudl take C if this role indeed existed in org. policy owners equals to CAE