CISA Question 404

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  Once the roles and responsibilities of the third-party provider are understood, the IS auditor can proceed to evaluate the organization's third-party monitoring process (Option C) to assess how effectively the organization manages and oversees the activities of the third-party service provider. However, reviewing the roles and responsibilities of the third-party provider comes first as it establishes the foundation for understanding the context and scope of the audit.

• 4

  B. Review the roles and responsibilities of the third- party provider.