ACC/ISA 305 Exam #Questions with correct answers
IT Governance (ITG) - ✔✔Framework for decision rights/accountability ensuring IT
supports business goals while managing risk/compliance/resources
Governance - ✔✔Strategic oversight/direction by board/senior management
Management - ✔✔Execution/operations/tactical implementation
Why are ITG frameworks popular? - ✔✔Provide structure, best practices,
consistency, risk management, compliance support, audit baseline, continuous
monitoring
Framework vs Standard - ✔✔Framework = flexible guidance; Standard = specific
mandatory requirement
Enterprise Risk Management (ERM) - ✔✔Organization-wide process
identifying/managing risk
Compliance - ✔✔Meeting laws, regulations, contracts, policies
Audit - ✔✔Independent assessment of controls/compliance
Assurance - ✔✔Broader evaluation of reliability/security/compliance
Control Objective - ✔✔Desired control outcome
, Risk - ✔✔Possibility threat exploits vulnerability causing harm
Threat - ✔✔Potential danger to asset
Vulnerability - ✔✔Weakness exploitable by threat
Countermeasure - ✔✔Control/action reducing risk
Residual Risk - ✔✔Remaining risk after controls
Due Care - ✔✔Acting responsibly/reasonably
Due Diligence - ✔✔Ongoing monitoring/maintenance of controls
CIA Triad - ✔✔Confidentiality, Integrity, Availability
Authentication - ✔✔Verify identity
Authorization - ✔✔Determine access AFTER authentication
Nonrepudiation - ✔✔Inability to deny action/communication
Risk Assessment - ✔✔Identify/analyze/prioritize risks
IT Governance (ITG) - ✔✔Framework for decision rights/accountability ensuring IT
supports business goals while managing risk/compliance/resources
Governance - ✔✔Strategic oversight/direction by board/senior management
Management - ✔✔Execution/operations/tactical implementation
Why are ITG frameworks popular? - ✔✔Provide structure, best practices,
consistency, risk management, compliance support, audit baseline, continuous
monitoring
Framework vs Standard - ✔✔Framework = flexible guidance; Standard = specific
mandatory requirement
Enterprise Risk Management (ERM) - ✔✔Organization-wide process
identifying/managing risk
Compliance - ✔✔Meeting laws, regulations, contracts, policies
Audit - ✔✔Independent assessment of controls/compliance
Assurance - ✔✔Broader evaluation of reliability/security/compliance
Control Objective - ✔✔Desired control outcome
, Risk - ✔✔Possibility threat exploits vulnerability causing harm
Threat - ✔✔Potential danger to asset
Vulnerability - ✔✔Weakness exploitable by threat
Countermeasure - ✔✔Control/action reducing risk
Residual Risk - ✔✔Remaining risk after controls
Due Care - ✔✔Acting responsibly/reasonably
Due Diligence - ✔✔Ongoing monitoring/maintenance of controls
CIA Triad - ✔✔Confidentiality, Integrity, Availability
Authentication - ✔✔Verify identity
Authorization - ✔✔Determine access AFTER authentication
Nonrepudiation - ✔✔Inability to deny action/communication
Risk Assessment - ✔✔Identify/analyze/prioritize risks
