Câu 450: CISA: Certified Information Systems Auditor

An IS auditor observes that exceptions have been approved for an organization's information security policy. Which of the following is MOST important for the auditor to confirm?

1. A. Exceptions do not change residual risk.
2. B. Exceptions are approved for predefined periods. — đáp án hiện tại
3. C. Exceptions require changes to the policy.
4. D. Exceptions are approved by the board of directors.