Exam CISA topic 1 question 1026 discussion

A privacy policy is an organization's policy for handling personal information. By creating and publishing a privacy policy, or obtaining consent to a privacy policy at the time personal information is collected, a company can satisfy many of its obligations under privacy laws.

When evaluating the development and design of a privacy program, an IS auditor's PRIMARY consideration should be industry practice and regulatory compliance guidance. This involves aligning the organization's privacy program with relevant laws, regulations, and industry best practices.

The IS auditor's PRIMARY consideration when evaluating the development and design of a privacy program should be: B. Industry practice and regulatory compliance guidance While all the options listed are important aspects of a privacy program, ensuring that the program aligns with industry best practices and complies with relevant regulations is typically the top priority. This provides a strong foundation for addressing privacy concerns effectively.

Policies and procedures consistent with privacy guidelines should be an IS auditor's primary consideration when evaluating the development and design of a privacy program. These policies and procedures ensure that personal information is collected, used, and disclosed in accordance with legal and ethical requirements.

A. Policies and procedures consistent with privacy guidelines