An IS auditor is conducting a post-implementation review of an enterprise resource planning (ERP) system. End users indicated concerns with the accuracy of critical automatic calculations made by the system. The auditor's FIRST course of action should be to:

• A.review recent changes to the system.
• B.review initial business requirements.
• C.verify results to determine validity of user concerns.
• D.verify completeness of user acceptance testing (UAT).

Comment: *

Name: *

Email: *

Verification: *

An organization is disposing of a system containing sensitive data and has deleted all files from the hard disk. An IS auditor should be concerned because:

• A.backup copies of files were not deleted as well.
• B.deleting all files separately is not as efficient as formatting the hard disk.
• C.deleting the files logically does not overwrite the files' physical data.
• D.deleted data cannot easily be retrieved.

Comment: *

Name: *

Email: *

Verification: *

What should an IS auditor do FIRST when a follow-up audit reveals some management action plans have not been initiated?

• A.Confirm whether the identified risks are still valid.
• B.Provide a report to the audit committee.
• C.Escalate the lack of plan completion to executive management.
• D.Request an additional action plan review to confirm the findings.

Comment: *

Name: *

Email: *

Verification: *

An IS auditor is reviewing an organization's information asset management process. Which of the following would be of GREATEST concern to the auditor'?

• A.The process does not require specifying the physical locations of assets
• B.Identification of asset value is not included in the process
• C.The process does not include asset review.
• D.Process ownership has not been established

Comment: *

Name: *

Email: *

Verification: *

When reviewing a data classification scheme, it is MOST important for an IS auditor to determine if.

• A.Senior IT managers are identified as information owner.
• B.each information asset is to a assigned to a different classification.
• C.the information owner is required to approve access to the asset
• D.the security criteria are clearly documented for each classification

Comment: *

Name: *

Email: *

Verification: *