IIA-CIA-PART2 · Question #175
An internal auditor is conducting an initial risk assessment of an audit area and wants to assess management's compliance with privacy laws for safeguarding customer information stored on the…
The correct answer is B. Obtain the most current approved copies of the organization's privacy policy. In the initial risk assessment phase, it is critical for the internal auditor to understand the current policies and procedures in place. By obtaining the most current approved copies of the organization's privacy policy, the auditor can assess whether these policies are in…
Question
An internal auditor is conducting an initial risk assessment of an audit area and wants to assess management's compliance with privacy laws for safeguarding customer information stored on the organization's servers. Which course of action is appropriate for this phase of the engagement?
Options
- ASolicit the services of a specialist information systems auditor
- BObtain the most current approved copies of the organization's privacy policy
- CConsult with legal counsel about new privacy laws to establish appropriate criteria
- DConsider the detection risk of noncompliance with the laws
How the community answered
(37 responses)- A5% (2)
- B84% (31)
- C3% (1)
- D8% (3)
Explanation
In the initial risk assessment phase, it is critical for the internal auditor to understand the current policies and procedures in place. By obtaining the most current approved copies of the organization's privacy policy, the auditor can assess whether these policies are in compliance with privacy laws and are effectively implemented. This approach provides a solid foundation for understanding the existing controls and identifying areas where there may be gaps or weaknesses. Consulting with legal counsel or a specialist can be subsequent steps if further expertise is needed, but understanding the internal policies is the primary and essential first step.
Topics
Community Discussion
No community discussion yet for this question.