Which of the following should be of GREATEST concern to an IS auditor reviewing an organization's customer relationship management (CRM) capability?

Question

Options

• AStaff are storing customer information in a Software as a Service (SaaS) tool that has not been
• BThe CRM tool does not have a long-term roadmap for new functionality and updates
• CThe business continuity plan (BCP) for the function under review has not been evaluated or
• DThe IT-provided CRM tool being used will no longer be supported by the vendor in one year

• A
  70% (42)
• B
  3% (2)
• C
  18% (11)
• D
  8% (5)

Explanation

Storing customer data in an unsanctioned SaaS tool represents an active, uncontrolled risk occurring right now - the organization has no visibility into how that data is secured, who can access it, whether it violates privacy regulations (GDPR, CCPA), or what the vendor's data handling policies are. This is a classic shadow IT scenario, and for an IS auditor, uncontrolled data exposure is always the most pressing concern over strategic or future risks.

Why the distractors are wrong:

• B (no long-term roadmap) is a vendor management concern, not an immediate security or compliance issue.
• C (BCP not evaluated) is a governance gap but represents a potential future risk, not an active data exposure happening today.
• D (end-of-support in one year) is a known risk with a defined timeline, giving the organization a clear window to act - far less urgent than data already sitting in an unvetted third-party system.

Memory tip: When choosing between IS audit risks, ask yourself "Is this happening right now with no controls?" - if yes, that's your greatest concern. Shadow IT with sensitive data is always an immediate red flag because it combines unauthorized access + no contractual protections + potential regulatory violations, all active simultaneously.

No community discussion yet for this question.