The effectiveness of an audit is measured by?

Question

Options

• AThe number of actionable items in the recommendations
• BHow it exposes the risk tolerance of the company
• CHow the recommendations directly support the goals of the company
• DThe number of security controls the company has in use

• A
  11% (6)
• B
  4% (2)
• C
  84% (48)
• D
  2% (1)

Explanation

Audit effectiveness is ultimately judged by whether the recommendations move the organization closer to its goals - an audit that surfaces findings irrelevant to the business provides little value, no matter how thorough it appears.

Why the distractors are wrong:

• A - A long list of actionable items signals quantity, not quality. Fifty irrelevant recommendations are less useful than one critical, goal-aligned one.
• B - Exposing risk tolerance is a byproduct of some audits, but it's not a measure of effectiveness; an audit can reveal risk appetite while still failing to help the organization improve.
• D - The count of security controls in place is an inventory metric, not an effectiveness measure. More controls doesn't mean the audit itself was effective or that the controls address real business risk.

Memory tip: Think of the audit as a GPS for the company. A good GPS doesn't just list every possible turn - it gets you to your destination. Audit recommendations that align with organizational goals = directions that actually matter.

No community discussion yet for this question.