(ISC)2 Certified in Cybersecurity Practice Exam

What term describes the independent review and examination of records and activities to assess system controls?

1. Security Assessment

2. Audit

3. Compliance Check

4. Review Process

The correct answer is: Audit

The term that describes the independent review and examination of records and activities to assess system controls is "Audit." An audit involves a systematic evaluation performed by an independent party, focusing on the effectiveness, efficiency, and accuracy of an organization’s internal controls, financial records, compliance with policies and regulations, and operational performance. Auditors collect and evaluate evidence, often using established frameworks or standards, to determine if a system's controls are functioning as intended. This process provides a level of assurance about the integrity and reliability of systems and processes within an organization. By being independent, audits help ensure objectivity and impartiality, making it a critical component in risk management and governance. In contrast, a "Security Assessment" refers more specifically to evaluating the security posture of a system and identifying vulnerabilities, rather than focusing on compliance and internal controls. A "Compliance Check" typically examines whether specific regulations or policies are being followed, and a "Review Process" could be more informal and may not involve the same level of rigor or independence as an audit.