CISA Question 184

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  When an IS auditor discovers that terminated users' accounts have not been disabled, this poses a security and fraud risk. The NEXT best step is to determine whether these accounts were used after termination, which would indicate unauthorized access or malicious activity. Why A is BEST: It helps assess actual impact or risk (e.g., did someone use the account to perform unauthorized transactions?). It provides evidence-based insights to support further action, such as escalation or control recommendations. It aligns with the principle of investigating before concluding or escalating. Why not the others? B. Conclude that IT general controls are ineffective ✘ Premature without first assessing actual usage or impact. C. Communicate risks to the application owner ✘ Important, but should follow a review of the account activity for context and severity. D. Perform substantive testing of terminated users' access rights ✘ Useful later, but activity review takes priority to assess whether the risk materialized.

• Chose C1

  an auditors job is to inform and detect and not necessarily review the access (although that could be the next step) answer C is the more correct answer for an auditor

• Chose A1

  Which is more important? C that helps enhance awareness of the owner or A investigate further to detect malicious activity? I will go with A. C comes next.