Question ID 22444	An IS auditor has been assigned to review IT structures and activities recently outsourced to various providers. Which of the following should the IS auditor determine FIRST?
Option A	That an audit clause is present in all contracts
Option B	That theSLA of each contract is substantiated by appropriate KPIs
Option C	That the contractual warranties of the providers support the business needs of the organization
Option D	That at contract termination, support is guaranteed by each outsourcer for new outsourcers
Correct Answer	C

Description The complexity of IT structures matched by the complexity and interplay of responsibilities and warranties may affect or void the effectiveness of those warranties and the reasonable certainty that the business needs will be met. All other choices are important, but not as potentially dangerous as the interplay of the diverse and critical areas of the contractual responsibilities of the outsourcers.
Update Date and Time 2018-03-26 06:11:05

 

Question ID 22448	While conducting an audit of a service provider, an IS auditor observes that the service provider has outsourced a part of the work to another provider. Since the work involves confidential information, the IS auditor's PRIMARY concern shouldbe that the:
Option A	requirement for protecting confidentiality of information could be compromised
Option B	contract may be terminated because prior permission from the outsourcer was not obtained.
Option C	other service provider to whom work has been outsourced is not subject to audit.
Option D	outsourcer will approach the other service provider directly for further work.
Correct Answer	A

Description Many countries have enacted regulations to protect the confidentiality of information maintained in their countries and/or exchanged with other countries. Where a service provider outsources part of its services to another service provider, there is a potential risk that the confidentiality of the information will be compromised. Choices B and C could be concerns but are not related to ensuring the confidentiality of information. There is no reason why an IS auditor should be concerned with choice D.
Update Date and Time 2018-03-29 06:52:51