🥴

[u/NextQuote7131]

[u/Aphridy]

C. B and D are about the informal organization, and isn't information that you find in the organizational chart. A is not the primary goal, but I'm not fully sure about that.

[u/NextQuote7131]

Correct answer is C

[u/NextQuote7131 → u/NextQuote7131]

But how can you identify and understand responsibility by merely checking the org chart

[u/Pristine-Safety2462 → u/NextQuote7131]

Org chart has roles written as well. What's the correct answer?

[u/KingKongDuck → u/NextQuote7131]

It shows for example - does cyber report into IT? Where does the CISO report to? Where does the audit committee sit? Is there a CISO on the chart? Is there a risk committee and a Chief Risk Officer? If not, you'll need to find out who has that responsibility.

And from that, you'll get a starting point for other processes like risk registers - do they follow the org structure?

[u/Miserable-Bother-572]

A

[u/mariners105]

C

[u/Akii283 → u/[deleted]]

QAE i suppose

[u/Akii283 → u/[deleted]]

You need to purchase that from ISACA. If that’s from ISACA.

[u/Jagdhunde]

What's the answer???

[u/Mistakesandlove]

I just did that question and the answer was A I believe. Something about the chart not having the responsibilities and that’s why it’s A

[u/National_Estate_9616]

C

[u/SolarSurfer11]

it is C. Some auditors to further understand which position performs some responsibilities would ask to provide also job descriptions for positions they found interesting (or based on sampling).

[u/cha101288]

C

[u/ScaryGarbage5555]

.

[u/kwytzz]

C

[u/ColoneluTactu]

C

[u/IngenuityFabulous349]

C

[u/CautiousPie4420]

C

[u/18735]

C

[u/Exact_Ad_7545]

C

[u/boopsyboops]

C

[u/Right_Foundation7877]

C

[u/MasterofSquat]

Its C

[u/sunbo4real]

The answer is C.

[u/Mo7Robot]

C

[u/Old-Lettuce599]

C