What is the difference between a policy and a procedure? O A policy is a high-level document signed by a person of authority, and compliance is mandatory. A procedure defines the mandatory steps to attain compliance. Compliance to a policy is discretionary, and compliance to a procedure is mandatory. A procedure provides discretionary advice to aid in decision making The policy defines specific requirements to ensure compliance A policy is a mid-level document issued to advise the reader of desired actions in the absence of a standard. The procedure describes suggested steps to use. How does the auditor derive a final opinion? From evidence gathered and the auditor's observations By representations and assurances of management By testing the compliance of language used in organizational policies e Under advice of the audit committee Which of the following is true concerning the roles of data owner, data user, and data custodian? The data owner specifies controls. The data user implements controls as necessary. The data custodian is responsible for specifing acceptable usage O The data custodian specifies security classification