Exam CISA topic 1 question 981 discussion

The correct answer is A, The audit team participates in risk scenario development workshops. The participation of the audit team in risk scenario development workshops is an indication that the organization's risk management practices are contributing to the effectiveness of internal IS audits. Risk scenario development involves identifying and analyzing potential risks and vulnerabilities that could affect the organization's information systems and networks. By participating in risk scenario development workshops, the audit team can gain a better understanding of the organization's risk profile and the potential impact of different types of risks on the organization's operations and objectives. This knowledge can help the audit team to more effectively identify and assess risks during internal IS audits, leading to more accurate and relevant audit findings and recommendations.

The Risk Register is one of many key components that help identify, assess, and mitigate the risks associated with a project from start to finish during each phase.

B. This is about audit using the corporate risk register to guide the audit activities which shows that internal audit function aligned with the organization's overall risk management framework

The best indication that an organization's risk management practices contribute to the effectiveness of internal IS audits is when the audit team actively participates in risk scenario development workshops. This suggests that there is collaboration and communication between the audit team and the risk management function. Participating in risk scenario development workshops allows the audit team to gain insights into the organization's risk landscape, understand potential risk scenarios, and align audit activities with the identified risks. It promotes a holistic approach to risk management and helps ensure that audit efforts are focused on areas of greatest concern to the organization.

It is also efficient for the audit team to participate in risk scenario development workshops or to use existing risk analysis templates. However, the Corporate Risk Register enables continuous assessment and reporting of the organization's risk management and internal control systems.