The GREATEST concern for an IS auditor reviewing vulnerability assessments by the auditee would be if the assessments are:

The correct answer is B. conducted once per year just before system audits are scheduled. The greatest concern would be if vulnerability assessments are only conducted once per year, as this frequency does not provide ongoing assurance of the system's security. Regular assessments are crucial for identifying vulnerabilities in a timely manner.

Submitted by ashley.k· Apr 18, 2026Information System Auditing Process

Question

Options

Aperformed for critical systems, not for the entire infrastructure
Bconducted once per year just before system audits are scheduled
Cperformed using open-source testing tools
Dconducted by the internal technical team instead of external experts

How the community answered

(24 responses)

A
21% (5)
B
67% (16)
C
8% (2)
D
4% (1)

Explanation

The greatest concern would be if vulnerability assessments are only conducted once per year, as this frequency does not provide ongoing assurance of the system's security. Regular assessments are crucial for identifying vulnerabilities in a timely manner.

Topics

#Vulnerability Assessments#IS Auditing#Vulnerability Management#Audit Effectiveness

Community Discussion

No community discussion yet for this question.

Full CISA Practice