CCSP · Question #667
During the course of an audit, which of the following would NOT be an input into the control requirements used as part of a gap analysis.
The correct answer is C. Vendor recommendations. Vendor recommendations would not be pertinent to the gap analysis after an audit. Although vendor recommendations will typically play a role in the development of corporate policies or contractual requirements, they are not required. Regulations, corporate policy, and…
Question
During the course of an audit, which of the following would NOT be an input into the control requirements used as part of a gap analysis.
Options
- AContractual requirements
- BRegulations
- CVendor recommendations
- DCorporate policy
How the community answered
(18 responses)- B6% (1)
- C89% (16)
- D6% (1)
Explanation
Vendor recommendations would not be pertinent to the gap analysis after an audit. Although vendor recommendations will typically play a role in the development of corporate policies or contractual requirements, they are not required. Regulations, corporate policy, and contractual requirements all determine the expected or mandated controls in place on a system.
Topics
Community Discussion
No community discussion yet for this question.