CISA Exam Dumps - Certified Information Systems Auditor

 An organization outsourced its IS functions. To meet its responsibility for disaster recovery, the organization should coordinate disaster recovery administration with the outsourcing vendor. This is because the organization remains accountable for ensuring the continuity and availability of its IS functions, even if they are outsourced to a third party. The organization should establish clear roles and responsibilities, communication channels, testing procedures, and escalation processes with the outsourcing vendor for disaster recovery purposes. The organization should not discontinue maintenance of the disaster recovery plan (DRP), as it still needs to have a documented and updated plan for restoring its IS functions in case of a disaster. The organization should not delegate evaluation of disaster recovery to a third party or internal audit, as it still needs to monitor and review the performance and compliance of the outsourcing vendor with respect to disaster recovery objectives and standards. References: CISA Review Manual (Digital Version), [ISACA Auditing Standards]

Periodic review of scheduled jobs is crucial to prevent unauthorized or outdated jobs from running, which could lead to security risks, data inconsistencies, or compliance issues. If the inventory of scheduled jobs is not reviewed periodically (A), it could result in jobs running with incorrect parameters, unauthorized transfers, or failure to decommission obsolete processes.

Other options:

Automated support ticket creation (B) is beneficial but is not as critical as ensuring the overall accuracy and security of job execution.

Restricting access to scheduling changes (C) is a security control, but its absence is not the most pressing concern compared to unreviewed jobs.

Notification alerts to a support group (D) is a good practice but does not replace the need for a formal review process.

If an auditor implemented a control, they would later be reviewing their own work, which creates a self-review threat and compromises independence. Participating in the project without operational responsibilities (B) or providing advice (C) is acceptable as long as the auditor does not take ownership of decisions. Designing audit modules (D) is also permissible since they are for audit use and do not affect operational processes. ISACA’s Code of Professional Ethics and IS Audit Standards emphasize independence and objectivity as fundamental requirements to maintain credibility and avoid conflicts of interest.

References (ISACA): ISACA Standards for IS Audit and Assurance; ISACA Code of Professional Ethics.

The most important factor for successful implementation of a corporate data classification program is having an approved data classification policy. ISACA guidance emphasizes that data classification must be directed and supported by top management and aligned with business objectives. Without a formally approved policy, the organization lacks authority, consistency, accountability, and an enterprise-wide basis for implementation.

Option D is correct because a policy provides the official framework that defines classification levels, ownership responsibilities, handling rules, protection expectations, and enforcement expectations. ISACA policy guidance also notes that enterprise policies formally document and communicate required and prohibited activities. A data classification program cannot be consistently implemented without this governance foundation.

Option A is useful but secondary. Best practices can help shape the design of the program, but they do not substitute for an approved internal policy. Organizations need formal internal direction before best practices can be operationalized consistently.

Option B is important in privacy-sensitive environments, but a privacy impact assessment is not the main prerequisite for a general corporate data classification program. A PIA addresses privacy risks in specific processing activities, while classification is a broader governance mechanism for all forms of data.

Option C is also not the most important. A DLP product may support enforcement, but tools should follow policy, not replace it. ISACA generally frames policy and governance as the foundation on which technical controls are later implemented.

Therefore, D is the best answer because policy approval is the key governance step that enables a corporate data classification program to be implemented successfully across the enterprise.

References (Official ISACA):

ISACA Journal, Security Adjustments to Strengthen the Bond Between Risk Registers and Information — data classification should be built under the direction of top management and aligned with business objectives.

ISACA Journal, same article — data classification should be approved by top management.

ISACA, New Policy Template Library Toolkit Equips Organizations to Build and Customize Policies — policies formally document and communicate required and prohibited activities.

ISACA, Practical Data Security and Privacy for GDPR and CCPA — data discovery and classification are critical, but they need governance support.

Given the large volume of data transactions, continuous monitoring is the best testing strategy for auditing the inventory control process. Continuous monitoring involves the automated review of operational and financial data to identify anomalies or areas of concern12. This approach allows for real-time identification and resolution of issues, making it particularly effective for large organizations with high transaction volumes12.