An IS auditor is reviewing how password resets are performed for users working remotely. Which type of documentation should be requested to understand the detailed steps required for this activity?

The correct answer is C. Procedures. Procedures provide the detailed, step-by-step instructions for how a specific task is to be performed - exactly what an auditor needs to understand the exact steps for remote password resets. Policies (B) state high-level management intent and rules ('passwords must be reset when

Submitted by suresh_in· Apr 18, 2026Information Systems Operations and Business Resilience

Question

Options

AGuidelines
BPolicies
CProcedures
DStandards

How the community answered

(22 responses)

A
5% (1)
C
86% (19)
D
9% (2)

Explanation

Procedures provide the detailed, step-by-step instructions for how a specific task is to be performed - exactly what an auditor needs to understand the exact steps for remote password resets. Policies (B) state high-level management intent and rules ('passwords must be reset when compromised') but not how to execute the task. Standards (D) define specific measurable requirements (e.g., password complexity rules). Guidelines (A) offer non-mandatory recommendations. Only procedures document the precise operational steps.

Topics

#Documentation types#Procedures#IS audit techniques#Password management

Community Discussion

No community discussion yet for this question.

Full CISA Practice