Isaca CISA Exam Dumps

Comprehensive and Detailed Step-by-Step

Theaudit charteris a formal document that definesthe purpose, authority, and responsibilitiesof the internal audit function.

Audit Charter (Correct Answer -- A)

Establishesroles, reporting structure, and independenceof the audit team.

Example:TheIS audit team's roleinrisk assessmentsis outlined in the charter.

Annual Audit Plan (Incorrect -- B)

Outlinesaudit activitiesbutdoes not define roles and responsibilities.

Engagement Letter (Incorrect -- C)

Used forspecific audits, not theentire audit function.

Audit Scope Letter (Incorrect -- D)

Detailswhat is coveredin an audit but doesnot define responsibilities.

ISACA CISA Review Manual

COBIT 2019 (Audit Governance)

The best method to delete sensitive information from storage media that will be reused is multiple overwriting. This is because multiple overwriting ensures that the data is practically unrecoverable by any software or hardware means. Multiple overwriting involves writing 0s, 1s, or random patterns onto all sectors of the storage media several times, making the original data unreadable or inaccessible.There arevarious software programs available that can securely delete files from storage media using multiple overwriting techniques1.

Crypto-shredding is not the best method because it only works for encrypted data. Crypto-shredding involves deleting the encryption key used to encrypt the data, making the data unreadable and unrecoverable.However, if the data is not encrypted, crypto-shredding will not erase it2.

Reformatting and re-partitioning are not the best methods because they do not erase the data completely.Reformatting and re-partitioning only delete the file system structures and pointers that make the data accessible, but thedata itself remains on the storage media and can be recovered using data recovery software

The most helpful thing for an IS auditor when assessing the effectiveness of controls is the results of control testing, as this provides objective and reliable evidence of how well the controls are designed and operating in practice. A control self-assessment (CSA) is a technique that involves the participation of process owners and stakeholders in evaluating the effectiveness of controls, but it may not be as rigorous or independent as control testing. Interviews with management are useful for gaining an understanding of the control environment and culture, but they may not reflect the actual performance of controls.A control matrix is a tool that maps the controls to the objectives, risks, and requirements, but it does not measure the effectiveness of controls.Reference:CISA Review Manual (Digital Version),Chapter 1: Information Systems Auditing Process, Section 1.3: IT Audit Process