CISA Question 72

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  They said Recent third-party audit reports (option A). Recent could vary (it could be from last year or the year before for example). While a third-party review provides a more objective assessment, the option did not specify how "recent" the report was. There could be certain changes that the organization had made that the external auditors had not captured yet. However, option B was able to specify that current & previous internal IS audit reports were made available, and it still gives that reasonable assurance of operational independence

• Chose D1

  D. Self-assessment reports of IT capability and maturity - So — in real-world consulting, A might give the acquirer higher confidence.In CISA exam logic, D is the better answer, because it directly measures framework effectiveness per ISACA’s governance model. - Self-assessments of IT capability and maturity (for example, based on COBIT maturity models) directly measure how well governance processes are defined, managed, measured, and optimized. They help determine governance effectiveness by showing how IT processes align with business goals, how responsibilities are assigned, and how performance is monitored. This is exactly the type of evidence an IS auditor would review to assess the maturity and effectiveness of an IT governance framework.

• Chose B2

  B provides objective, detailed evidence of internal processes, controls, risk management practices, and compliance with organizational and industry policies, which are crucial for a thorough evaluation.