MENU
What should an IS auditor evaluate FIRST when reviewing an organization's response to new privacy legislation?
Suggested Answer: D
Get Premium CISA Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
This is according to the ISACA's IS Auditing Guideline G14 on Privacy and Data Protection, which states that an IS auditor should first evaluate the organization's ability to identify and assess the systems that contain privacy components, and then review the adequacy of the operational plan for achieving compliance with the legislation.
16 comments · newest first
IL
Iluminada
10 months ago
Other countries' laws could help shape our approach too!
JA
Jarvis
11 months ago
Wait, are we sure the legislation is even clear enough?
IE
Iesha
11 months ago
But what about analyzing existing systems first?
ST
Stephanie
11 months ago
Definitely agree, compliance starts with that!
BR
Brianne
11 months ago
I think the implementation plan is key.
DE
Dell
12 months ago
I practiced a question similar to this, and I think looking at privacy legislation in other countries could be relevant, but it might not be the top priority.
SH
Shaniqua
12 months ago
I feel like analyzing systems with privacy components might be crucial too, but I can't recall if that's the first step.
ME
Merlyn
12 months ago
I'm not entirely sure, but I remember something about the importance of understanding the implementation plan for restricting personal information.
TA
Tatum
1 year ago
I think the first thing to evaluate should be the operational plan for compliance. It seems like a logical starting point.
CI
Ciara
1 year ago
Okay, I've got this. The correct answer is C - the operational plan for achieving compliance with the legislation. That's going to be the foundation for everything else, so it makes sense to start there and then work outward from there.
JI
Jina
1 year ago
I've got a good strategy for this. I think the first thing I'd evaluate is the organization's analysis of the systems that contain privacy components. That's going to be crucial for understanding how they're currently handling personal information and where they need to make changes.
LU
Luisa
1 year ago
I'm a little confused by this question. Should I be focusing on the internal processes and systems, or looking at the broader legal landscape? I'm not sure if I should start with the operational plan or the analysis of the systems that contain privacy components.
JE
Jeanice
1 year ago
Okay, let me think about this. I'm not totally sure, but I feel like the implementation plan for restricting the collection of personal information would be the best place to start. That seems like the core of what the new legislation is addressing.
MA
Marvel
1 year ago
Hmm, this is a tricky one. I think I'd start by looking at the organization's operational plan for achieving compliance with the new privacy legislation. That seems like the most logical first step to me.
FR
Francine
1 year ago
Okay, I think I've got a good handle on this. The key things to remember are that INTERSECT returns the common rows, and the order and number of columns don't matter. I'll focus on those points in my answer.
BO
Bobbie
1 year ago
Hmm, this looks like a tricky time-related question. I'll need to think it through carefully.