Câu 270: CISA: Certified Information Systems Auditor

An IS auditor is evaluating controls for monitoring the regulatory compliance of a third party that provides IT services to the organization. Which of the following should be the auditor's GREATEST concern?

1. A. A gap analysis against regulatory requirements has not been conducted.
2. B. The third-party disclosed a policy-related issue of noncompliance.
3. C. The organization has not reviewed the third party's policies and procedures.
4. D. The organization has not communicated regulatory requirements to the third party. — đáp án hiện tại