CISA Exam Dumps - Certified Information Systems Auditor

The greatest segregation of duties conflict would occur if the individual who performs the related tasks also has approval authority for purchase requisitions and purchase orders. This is because these two tasks are directly related to each other and involve financial transactions. If the same person is responsible for both tasks, it could lead to potential fraud or error12. For instance, the individual could approve a purchase order for a personal need and then also approve the payment for it, leading to misuse of company funds12.

The auditor implemented a specific control during the development of the system. This would impair the auditor’s independence, as it would create a self-review threat, which is a situation where an auditor has to evaluate or review the results of his or her own work or judgment1. A self-review threat may compromise the auditor’s objectivity and impartiality, as the auditor may be biased or influenced by his or her own involvement or interest in the system1. The auditor may also face a conflict of interest or a loss of credibility if he or she has to report on any issues or deficiencies related to the control he or she implemented.

The correct answer is C. Reviewing escalated project issues.

A steering committee provides governance, oversight, prioritization, funding direction, issue escalation, and decision-making support for major initiatives. In a digital transformation program, the steering committee is most likely to review escalated project issues, resolve conflicts, approve major decisions, and ensure the program remains aligned with business objectives.

ISACA guidance on digital transformation governance highlights the importance of project governance frameworks, steering committees, and escalation paths. ISACA also describes executive steering committees as bodies that guide strategy, approve funding, make formal risk decisions, and support clear escalation paths and decision-making protocols.

Option A is not correct because designing interface controls is a technical/system design responsibility. Option B is usually performed by business analysts, process owners, and project teams. Option D is usually prepared by the project manager or program manager, although the steering committee may review the status reports.

This question maps to Governance and Management of IT, because steering committees are part of IT governance, strategic oversight, resource allocation, and project/program governance.

Issuing authentication tokens is the most reliable method of preventing unauthorized logon, as it provides a strong form of authentication that requires users to present something they have (the token) and something they know (the personal identification number or PIN) to access the system. Authentication tokens are physical devices that generate a one-time password or code that changes periodically and is synchronized with the authentication server. This makes it difficult for attackers to steal or guess the credentials of legitimate users. Reinforcing current security policies, limiting after-hours usage and installing an automatic password generator are not as reliable as issuing authentication tokens, as they do not provide a strong form of authentication and may still be vulnerable to unauthorized logon attempts. References:

[Authentication Token Definition]

 Authentication | ISACA

The IS auditor should inform audit management of the earlier involvement in designing the application. This is to ensure that there is no conflict of interest or bias that may affect the objectivity or independence of the audit. Audit management can then decide whether to assign a different auditor or to proceed with the same auditor with appropriate safeguards. The other options are not appropriate for the IS auditor to do in this situation. Refusing the assignment to avoid conflict of interest is an extreme measure that may not be necessary or feasible, especially if there are no other qualified auditors available. Using the knowledge of the application to carry out the audit is risky, as it may lead to overlooking or ignoring potential issues or errors in the application. Modifying the scope of the audit is not advisable, as it may compromise the quality or completeness of the audit. References: CISA Review Manual (Digital Version), Chapter 2, Section 2.1

The greatest risk associated with an incomplete inventory of deployed software in an organization is the inability to deploy updated security patches. Security patches are updates that fix vulnerabilities or bugs in software that could be exploited by attackers. Without an accurate inventory of software versions and configurations, it is difficult to identify and apply the relevant patches in a timely manner, which exposes the organization to increased security risks. Inability to close unused ports on critical servers, inability to identify unused licenses within the organization, and inability to determine the cost of deployed software are not as critical as security risks. References: ISACA CISA Review Manual 27th Edition, page 308