10. Perfect compliance with an IT Control Framework is not a guarantee of security because:

		The EU's General Data Protection Regulation superseded all other frameworks
		They do not address the Internet of Things (IoT)
		None of the current IT Control Framework are certified by the US Federal Govt
		New threats and vulnerabilities are constantly emerging

16. Jose is an auditor for a regional auditing firm. His firm has been retained by The Kroger Company. Which of the following could compromise his independence?

		The auditor typically buys groceries at Kroger.
		The auditor does not follow the International Standards for Professional Practice.
		The auditor's mother is the VP for Marketing at Kroger.
		The auditor has invested in a mutual fund and the fund has invested in Kroger.

17. Declan wasn't happy with the document destruction service he had retained to dispose of sensitive paper documents. He learned from a friend that the destruction service often sent paper directly to a recycling service instead of shredding the documents. Declan's procurement effort did not include checking to see if the destruction service had appropriate certifications. Declan:

		Neglected to conduct meaningful due diligence
		Failed to provide secure onsite storage in his office
		Should not dwell on trivial matters like this; nothing will happen
		Accepted the risk of not destroying unneeded sensitive data

18. Logan (an auditor) has completed testing for the IT General Controls audit and is preparing for the Exit Conference with management. One matter related to the authentication system is important for management to address because it affects a number of people, but presents little risk and could be resolved quickly. Logan is also certain management can appropriately address the problem without the need for further oversight. What level of reporting would be the most appropriate?

		Major Report Finding
		Finding for Recovery
		Minor Report Finding
		Management Letter or Exit Conference Agenda

19. Who audits the auditors?

		Other auditors
		The Board of Directors / Trustees
		Arthur Andersen LLP
		The Police (Sting, Andy Summers, Stewart Copeland)

20. The proper order of the audit process is:

		Notification Letter, Entrance Conference, Preliminary Meetings, Fieldwork, Exit Conference, and Final Report
		Notification Letter, Entrance Conferences, Preliminary Meetings, Drink Coffee, Procrastinate, Conduct Tests in a Big Hurry, Dream Up Some Findings, Hastily Write Report, and Go on Vacation.
		Exit Conference, Notification Letter, Entrance Conference, Preliminary Meetings, Final Report
		Preliminary Meetings, Notification Letter, Entrance Conferences, Fieldwork, Final Report, Exit Conference