1. In the context of selecting controls, the term requirement can be used to refer to all of the following EXCEPT:

a. It includes both legal and policy requirements, as well as an expression of the broader set of stakeholder protection needs that may be derived from other sources.

b. Conditions that the external auditor is requiring in order to close out findings

c. An expression of stakeholder protection needs for a particular system or organization.

d. The information security and privacy obligations imposed on organizations.

2. Which of the following is a governmental standards body that issues standards for auditing the Federal government?

Group of answer choices

a. OMB

b. U.S. Treasury

c. GAO

d. SEC

3. A good audit flowchart will document all except:

Systems Involved

System Owner

Process Steps

Controls