Skip to content

CS Professional · Internal and Forensic Audit · Emerging Issues and Challenges

Kaveri Retail Ltd's internal auditor wants to test whether the company's staff can recognise phishing attempts. Which audit approach best provides evidence on this?

A simulated phishing exercise, analysing how many employees click and how many report the email, best tests staff awareness. It gives direct evidence on the human control, whereas reviewing firewall rules or unrelated logs does not show whether employees recognise phishing.

  1. AReview the firewall rule base only
  2. BConduct a simulated phishing exercise and analyse the click and reporting ratesCorrect
  3. CVerify the depreciation policy for computers
  4. DExamine the fire extinguisher inspection log

Explanation

Staff awareness is a human control best tested by a simulated phishing campaign, measuring how many click and how many report. A firewall review tests a technical control, and the other options are unrelated to awareness.

Did you get it right without looking?

One question tells you little. A timed set on Emerging Issues and Challenges shows your real accuracy, how long you take and where you lose marks.

Practise Emerging Issues and ChallengesFree diagnostic mock

More Emerging Issues and Challenges questions