Which of the following should an internal auditor check for first when conducting an audit of the organization's risk management program?

□□

When conducting an audit of an organization's risk management program, the initial

step is to understand the established framework and intended controls. Policies and

procedures define the objectives, scope, roles, responsibilities, and processes of the

risk management program. Auditors review these documents first to establish the

criteria against which the program's design and operational effectiveness will be

evaluated. Without understanding the documented requirements, an auditor cannot

effectively assess other components of the program.

· B. Asset management: This is a critical component within a risk management

program. Auditors verify asset management practices against the organization's

policies and procedures, which are reviewed first.

· C. Vulnerability assessment: This is a technical activity conducted as part of the risk

management process. Auditors check if vulnerability assessments are performed

according to established policies and procedures, making the latter the initial focus.

· D. Business impact analysis: This analysis is an input to risk management

and business continuity planning. Its execution is typically mandated and guided

by organizational policies, which an auditor would examine first.

1. NIST Special Publication 800-53A, Revision 5: Assessing Security and

Privacy Controls in Information Systems and Organizations.

o URL: https://csrc.nist.gov/publications/detail/sp/800-53a/rev-5/final

o Specific Reference: Section 2.2, "Assessment Process," Table P-1, Task P-3

("Preparation Phase"): "Obtain and review current versions of key documents (e.g.,

policies, procedures, security and privacy plans, security and privacy assessment

reports, and other relevant documents related to the system and its environment of

operation) to understand the system, its context, and the controls that are to be

assessed." This highlights that reviewing policies and procedures is a foundational

preparatory step in an assessment.

2. NIST Special Publication 800-39: Managing Information Security Risk:

Organization, Mission, and Information System View.

o URL: https://csrc.nist.gov/publications/detail/sp/800-39/final

o Specific Reference: Section 2.1, "Key Concepts," page 5: "An effective, organization-

wide information security risk management program requires the commitment of senior

leaders and the support of all personnel within an organization. It also requires a well-

defined governance structure, including clearly articulated risk management policies,

procedures, and guidance..." An audit of such a program would logically begin by

examining these defining documents.

3. NIST Special Publication 800-37, Revision 2: Risk Management Framework for

Information Systems and Organizations: A System Life Cycle Approach for

Security and Privacy.

o URL: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

o Specific Reference: Section 2.1, "Risk Management Framework Overview,"

emphasizes that organizational policies (Tier 1) provide the foundation for the risk

management process. An audit of the program would start by understanding this

foundation.