nerdexam
Isaca

CISA · Question #143

Which of the following should be an IS auditor's PRIMARY focus when auditing the implementation of a new IT operations performance monitoring system?

The correct answer is A. Validating whether baselines have been established. An IS auditor's primary focus when auditing a new IT operations performance monitoring system should be validating the establishment of performance baselines, as these are crucial for effective monitoring and identifying deviations.

Submitted by omar99· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Which of the following should be an IS auditor’s PRIMARY focus when auditing the implementation of a new IT operations performance monitoring system?

Options

  • AValidating whether baselines have been established
  • BReviewing whether all changes have been implemented
  • CDetermining whether there is a process for annual review of the maintenance manual
  • DConfirming whether multi-factor authentication (MFA) is deployed as part of the operational

How the community answered

(38 responses)
  • A
    82% (31)
  • B
    5% (2)
  • C
    3% (1)
  • D
    11% (4)

Why each option

An IS auditor's primary focus when auditing a new IT operations performance monitoring system should be validating the establishment of performance baselines, as these are crucial for effective monitoring and identifying deviations.

AValidating whether baselines have been establishedCorrect

Performance monitoring systems are designed to detect deviations from normal operations. Without established baselines, it is impossible to accurately identify abnormal performance, making the system ineffective for its primary purpose of detecting and alerting on operational issues.

BReviewing whether all changes have been implemented

Reviewing whether all changes have been implemented relates to project management and change control, which is important but secondary to ensuring the system can perform its core function of monitoring effectively.

CDetermining whether there is a process for annual review of the maintenance manual

A process for annual review of the maintenance manual is a good practice for documentation upkeep, but it does not directly impact the immediate operational effectiveness or validity of the monitoring data collected by the system.

DConfirming whether multi-factor authentication (MFA) is deployed as part of the operational

Confirming MFA deployment is a security control relevant to accessing the system itself, but it is not the primary measure of the system's ability to monitor IT operations performance effectively.

Concept tested: Performance monitoring system baseline validation

Topics

#IT Operations Monitoring#Performance Baselines#System Implementation Audit#Auditor Focus

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISA Practice