Question

1. Which of the following best describes what is meant by corporate governance?

Multiple Choice

• The organizational structure and responsibilities of the executive team and board of directors of a corporation.

• Regulatory bodies, such as the SEC and PCAOB, that govern the behavior of corporations.

• The ability of a corporation’s management team to meet earnings forecasts over an extended period of time.

• Management’s processes, policies, and ethical approach to safeguarding stakeholder interests.

2. Which of the following is not included in the remediation phase for vulnerability management?

Multiple Choice

• Risk Response Plan

• Policy and procedures for remediation

• Vulnerability Prioritization

• Control Implementation

3. Which of the following controls would most likely assure that a company can reconstruct its financial records?

Multiple Choice

• Security controls such as firewalls

• Backup data are tested and stored safely

• Personnel understand the data very well

• Paper records

Answer 1

1. (d) Management’s processes, policies, and ethical approach to safeguarding stakeholder interests.

Explanation:

Corporate governance refers to the structure of rules, practices and processes used by board of directors of a corporation to monitor the actions, policies and decisions of corporation and affected stakeholders. The plans and policies should be aligned with the interest of stakeholders.

2. (d) Control Implementation

Explanation:

Vulnerability is defined as a weakness in the system that leaves the system open to potential risk. Remediation phase of vulnerability management involves monitoring and taking corrective actions to remove vulnerability. This phase involves Risk Response Plan, Policy and procedures for remediation and Vulnerability Prioritization. Control implementation is not a part of remediation phase.

3. (b) Backup data are tested and stored safely

Explanation:

Proper data backup can only help in data reconstruction.

Choice (a) is not appropriate because it help to protect data from unauthorized access. Choice (c) is not appropriate because personnel understanding cannot help to reconstruct the data as it is not possible to memorize data for the purpose of reconstruction. Choice (d) is not feasible as paper records are not sufficient for the reconstruction of data on large scale.