BTW, DOWNLOAD part of ExamCost CISA dumps from Cloud Storage: https://drive.google.com/open?id=16T2XJyWwP3O7s0osyzFqmQga_aOw5UZG
ExamCost also provides three months of free updates, if for instance, the content of Certified Information Systems Auditor (CISA) exam questions changes after you purchase the CISA Practice Exam. So just jump straight toward ExamCost for your preparation for the ISACA CISA certification exam.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Information Systems Acquisition, Development and Implementation | 12% | - Project Management Controls - System Development Lifecycle (SDLC) - Testing and Implementation Controls |
| Topic 2: Governance and Management of IT | 17% | - IT Governance Frameworks - Risk Management and Compliance - IT Policies and Procedures |
| Topic 3: Protection of Information Assets | 27% | - Information Security Governance - Access Control and Identity Management - Data Protection and Security Monitoring |
| Topic 4: Information Systems Operations and Business Resilience | 23% | - Service Level Management - IT Operations Management - Business Continuity and Disaster Recovery |
| Topic 5: Information Systems Auditing Process | 21% | - Audit Reporting and Follow-up - Audit Planning and Execution - Audit Standards and Guidelines |
The competition is in the tech sector is getting tougher and tougher day by day. Therefore, ExamCost is offering updated and latest ISACA CISA Questions so aspirants can ace the ISACA CISA test in a short time and stay competitive in today's challenging job market.
NEW QUESTION # 975
Which of the following would be an appropriate rote of internal audit in helping to establish an organization ' s privacy program?
Answer: D
Explanation:
Analyzing risks posed by new regulations is an appropriate role of internal audit in helping to establish an organization's privacy program. An internal auditor can provide assurance and advisory services on the compliance and effectiveness of the privacy program, as well as identify and assess the potential risks and impacts of new or changing privacy regulations. The other options are not appropriate roles of internal audit, but rather the responsibilities of the management, the information security officer, or the privacy officer. References:
CISA Review Manual (Digital Version), Chapter 7, Section 7.4.21
CISA Review Questions, Answers and ExplanationsDatabase, Question ID 216
NEW QUESTION # 976
Identify the correct sequence of Business Process Reengineering (BPR) application steps from the given choices below?
Answer: B
Explanation:
Section: Information System Acquisition, Development and Implementation Explanation Explanation:
The correct sequence of BRP application step is Envision, Initiate, Diagnose, Redesign, Reconstruct and Evaluate.
For your exam you should know the information below:
Overview of Business Process Reengineering
One of the principles in business that remains constant is the need to improve your processes and procedures. Most trade magazines today contain discussions of the detailed planning necessary for implementing change in an organization. The concept of change must be accepted as a fundamental principle. Terms such as business evolution and continuous improvement ricochet around the room in business meetings. It's a fact that organizations which fail to change are destined to perish.
As a CISA, you must be prepared to investigate whether process changes within the organization are accounted for with proper documentation. All internal control frameworks require that management be held responsible for safeguarding all the assets belonging to their organization. Management is also responsible for increasing revenue.
BPR Application Steps
ISACA cites six basic steps in their general approach to BPR. These six steps are simply an extension of Stewart's Plan-Do-Check-Act model for managing projects:
Envision -Visualize a need (envision). Develop an estimate of the ROI created by the proposed change.
Elaborate on the benefit with a preliminary project plan to gain sponsorship from the organization. The plan should define the areas to be reviewed and clarify the desired result at the end of the project (aka end state objective). The deliverables of the envision phase include the following:
Project champion working with the steering committee to gain top management approval Brief description of project scope, goals, and objectives description of the specific deliverables from this project with a preliminary charter to evidence management's approval, the project may proceed into the initiation phase.
Initiate -This phase involves setting BPR goals with the sponsor. Focus on planning the collection of detailed evidence necessary to build the subsequent BPR plan for redesigning the process. Deliverables in the initiation phase include the following:
Identifying internal and external requirements (project specifications) Business case explaining why this project makes sense (justification) and the estimated return on investment compared to the total cost (net ROI) Formal project plan with budget, schedule, staffing plan, procurement plan, deliverables, and project risk analysis Level of authority the BPR project manager will hold and the composition of any support committee or task force that will be required From the profit and loss (P&L) statement, identify the item line number that money will be debited from to pay for this project and identify the specific P&L line number that the financial return will later appear under (to provide strict monitoring of the ROI performance) Formal project charter signed by the sponsors It's important to realize that some BPR projects will proceed to their planned conclusion and others may be halted because of insufficient evidence. After a plan is formally approved, the BPR project may proceed to the diagnostic phase.
Diagnose Document existing processes. Now it's time to see what is working and identify the source of each requirement. Each process step is reviewed to calculate the value it creates. The goal of the diagnostic phase is to gain a better understanding of existing processes. The data collected in the diagnostic phase forms the basis of all planning decisions:
Detailed documentation of the existing process
Performance measurement of individual steps in the process
Evidence of specific process steps that add customer value
Identification of process steps that don't add value
Definition of attributes that create value and quality
Put in the extra effort to do a good job of collecting and analyzing the evidence. All future assumptions will be based on evidence from the diagnostic phase.
Redesign- Using the evidence from the diagnostic phase, it's time to develop the new process.
This will take several planning iterations to ensure that the strategic objectives are met. The formal redesign plans will be reviewed by sponsors and stakeholders. A final plan will be presented to the steering committee for approval. Here's an example of deliverables from the redesign phase.
Comparison of the envisioned objective to actual specifications
Analysis of alternatives (AoA)
Prototyping and testing of the redesigned process
Formal documentation of the final design
The project will need formal approval to proceed into the reconstruction phase. Otherwise, the redesign is halted pending further scrutiny while comparing the proposed design with available evidence. Insufficient evidence warrants halting the project.
Reconstruct With formal approval received, it's time to begin the implementation phase.
The current processes are deconstructed and reassembled according to the plan. Reconstruction may be in the form of a parallel process, modular changes, or complete transition. Each method presents a unique risk and reward opportunity. Deliverables from this phase include the following:
Conversion plan with dependencies in time sequence
Change control management
Execution of conversion plan with progress monitoring
Training of users and support personnel
Pilot implementation to ensure a smooth migration
Formal approval by the sponsor.
The reconstructed process must be formally approved by management to witness their consent for fitness of use. IT governance dictates that executive management shall be held responsible for any failures and receive recognition for exceptional results. System performance will be evaluated again after entering production use.
Evaluate (post evaluation) The reconstructed process is monitored to ensure that it works and is producing the strategic value as forecast in the original justification.
Comparison of original forecast to actual performance Identification of lessons learned Total quality management plan to maintain the new process A method of continuous improvement is implemented to track the original goals against actual process performance. Annual reevaluation is needed to adapt new requirements or new opportunities.
Benchmarking as a BPR Tool
Benchmarking is the process of comparing performance data (aka metrics). It can be used to evaluate business processes that are under consideration for reengineering. Performance data may be obtained by using a self-assessment or by auditing for compliance against a standard (reference standard). Evidence captured during the diagnostic phase is considered the key to identifying areas for performance improvement and documenting obstacles. ISACA offers the following general guidelines for performing benchmarks:
Plan Identify the critical processes and create measurement techniques to grade the processes.
Research Use information about the process and collect regular data (samples) to build a baseline for comparison. Consider input from your customers and use analogous data from other industries.
Observe Gather internal data and external data from a benchmark partner to aid the comparison results.
Benchmark data can also be compared against published standards.
Analyze Look for root cause-effect relationships and other dependencies in the process. Use predefined tools and procedures to collate the data collected from all available sources.
Adapt Translate the findings into hypotheses of how these findings will help or hurt strategic business goals. Design a pilot test to prove or disprove the hypotheses.
Improve Implement a prototype of the new processes. Study the impact and note any unexpected results.
Revise the process by using controlled change management. Measure the process results again. Use reestablished procedures such as total quality management for continuous improvement.
The following answers are incorrect:
The other options specified does not represent the correct sequence of BRP application steps.
Reference:
CISA review manual 2014 page number 219 to 211
CISA certified information system auditor study guide Second Edition Page Number 154 to 158
NEW QUESTION # 977
When responding to an ongoing Daniel of service (DoS) attack, an organization's FIRST course of action should be to:
Answer: A
NEW QUESTION # 978
Which of the following risk scenarios is BEST addressed by implementing policies and procedures related to full disk encryption?
Answer: A
NEW QUESTION # 979
An organization has introduced a capability maturity model to the system development life cycle (SDLC) to measure improvements. Which of the following is the BEST indication of successful process improvement?
Answer: C
NEW QUESTION # 980
......
We provide online customer service to the customers for 24 hours per day and we provide professional personnel to assist the client in the long distance online. If you have any questions and doubts about the Certified Information Systems Auditor guide torrent we provide before or after the sale, you can contact us and we will send the customer service and the professional personnel to help you solve your issue about using CISA Exam Materials. The client can contact us by sending mails or contact us online. We will solve your problem as quickly as we can and provide the best service. Our after-sales service is great as we can solve your problem quickly and won’t let your money be wasted. If you aren’t satisfied with our CISA exam torrent you can return back the product and refund you in full.
Latest CISA Cram Materials: https://www.examcost.com/CISA-practice-exam.html
BONUS!!! Download part of ExamCost CISA dumps for free: https://drive.google.com/open?id=16T2XJyWwP3O7s0osyzFqmQga_aOw5UZG