Audits and Assessments

1. A CISO explains to the board: "After reviewing our systems and controls, our independent auditor will provide a formal statement of their professional opinion about whether our security posture is accurate and whether our compliance claims are truthful." What term describes this formal professional opinion?

A. Audit report; it documents findings from the examination process and constitutes the auditor's formal professional opinion B. Attestation; it is the formal professional opinion regarding the accuracy or reliability of an organization's security posture, typically issued after an audit gathers and evaluates evidence C. Certification; organizations receive a compliance certification when they pass an external audit D. Self-assessment; the organization evaluates its own security posture and reports the findings to the board

2. A company's security governance structure includes a committee responsible for authorizing all internal audits, overseeing risk management activities, reviewing audit findings, and ensuring corrective actions are implemented. Which governance body is described?

A. The compliance team; they are responsible for managing regulatory requirements and ensuring all compliance controls are in place B. The audit committee; it oversees all risk management activities and all internal audits start and stop with the audit committee's authorization and review C. The security operations center (SOC); it monitors security events and manages incident response, including audit-related findings D. The CISO; the Chief Information Security Officer has ultimate authority over all audit activities as the senior security executive

3. A healthcare organization requires every department to periodically evaluate its own security controls, data handling practices, and HIPAA compliance status against a checklist. Results are submitted to the compliance team and consolidated into an organizational risk report. What type of audit activity is this?

A. External audit; an independent third party is evaluating each department's compliance status B. Self-assessment; departments evaluate their own compliance and security practices against established criteria, with results consolidated into organizational reports for the audit committee C. Penetration test; the organization is actively testing whether its controls are functioning against real-world attack scenarios D. Compliance audit; an internal team separate from operations performs the evaluation to maintain independence

4. A retail company processes credit card transactions. Regulators inform the company that it must undergo an annual security assessment conducted by a Qualified Security Assessor (QSA) from an independent firm. The company cannot choose whether to have this assessment — it is required by the applicable standard. What type of audit is this, and what drives its requirement?

A. An internal audit; the company's audit committee has determined that an independent QSA provides better objectivity than internal staff B. An external audit mandated by PCI DSS; regulatory requirements determine the type, scope, and frequency of external audits, and organizations subject to those regulations cannot opt out C. A vulnerability assessment; QSAs perform vulnerability scanning as part of PCI DSS compliance verification D. A self-assessment; PCI DSS allows organizations to conduct self-assessments using QSA-provided questionnaires without requiring an external firm

5. An external auditor spends two weeks at a financial institution examining system configurations, reviewing access logs, interviewing IT administrators about security procedures, and collecting documentation that supports the audit conclusions. What term describes this hands-on phase of the audit process?

A. Attestation; the auditor is formally verifying the organization's security posture through direct evidence collection B. Examination; external audits require hands-on research where auditors review records, examine configurations, interview employees, and gather evidence — they do not simply accept the organization's self-reported claims C. Reconnaissance; the auditor is gathering information about the organization's systems before making compliance determinations D. Penetration testing; the auditor is actively testing security controls by attempting to access systems and gathering evidence of what is accessible

6. A security manager argues for implementing a regular internal audit program. She states: "The single most important security benefit is that audits allow us to find our weaknesses on our schedule, rather than having attackers find them on theirs." Which benefit of cybersecurity audits is she describing?

A. Improved reputation; regular audits demonstrate strong security practices to customers and business partners B. Proactive vulnerability identification; audits can discover security weaknesses before attackers exploit them, allowing the organization to remediate on its own timeline rather than responding to a breach C. Regulatory compliance; internal audits satisfy all regulatory requirements and eliminate the need for external auditors D. Accountability; audits ensure employees follow policies by creating a documented record of who did what on organizational systems

Matching: Audit Concepts

Match each concept (1–4) to its correct description (A–D).

1Audit Committee

2Attestation

3Self-Assessment

4External Audit

AFormal professional opinion of the truth or accuracy of an organization's security posture, issued after an independent examination

BIndependent third-party examination often mandated by regulation; provides high-credibility findings because the auditor has no financial stake in the outcome

CGovernance body responsible for risk management oversight; all internal audits start and stop with this body's authorization and review

DDepartment-level evaluation of own compliance and security practices; results consolidated into organizational reports that provide visibility into overall security health

Audits and Assessments — Quiz