Free Certified Information Systems Security Professional (CISSP) Practice Questions

The correct matching of the functional roles and their responsibilities in an external audit is:

• Executive management: Approve audit budget and resource allocation
• Audit committee: Provide audit oversight
• Compliance officer: Ensure the achievement and maintenance of organizational requirements with applicable certifications
• External auditor: Develop and maintain knowledge and subject-matter expertise relevant to the type of audit

Comprehensive Explanation: An external audit is an independent and objective examination of an organization’s financial statements, systems, processes, or performance by an external party. The functional roles and their responsibilities in an external audit are:

• Executive management: The highest-ranking executives in the organization, who have the authority and responsibility for the overall direction and performance of the organization. They approve the audit budget and resource allocation, as well as the scope and objectives of the audit.
• Audit committee: A subcommittee of the board of directors, who oversee the audit activities and ensure the quality and integrity of the audit process. They provide audit oversight, such as selecting and appointing the external auditor, reviewing and approving the audit plan and report, and monitoring the implementation of the audit recommendations.
• Compliance officer: A person who is responsible for ensuring that the organization complies with the applicable laws, regulations, standards, and policies. They ensure the achievement and maintenance of organizational requirements with applicable certifications, such as ISO, PCI, or HIPAA, and coordinate with the external auditor to provide the necessary evidence and documentation.
• External auditor: A person who is hired by the audit committee or the executive management to conduct the external audit. They develop and maintain knowledge and subject-matter expertise relevant to the type of audit, such as financial, operational, or security audit, and follow the professional standards and guidelines for conducting the audit.

References: CISSP All-in-One Exam Guide