Question

An IS auditor finds that not all employees are aware of the enterprise's information security policy. The IS auditor should conclude that:

a). This lack of knowledge may lead to unintentional disclosure of sensitive information.
b). Information security is not critical to all functions.
c). IS audit should provide security training to the employees.
d). The audit finding will cause management to provide continuous training to staff.

Answer 1

An IS auditor's finding that employees are unaware of the enterprise's information security policy indicates a risk for unintentional disclosure of sensitive information. The auditor should recommend improving policy awareness, but providing training goes beyond their role.

Step-by-step explanation:

The student's question relates to the findings of an IS auditor regarding employee awareness of the enterprise's information security policy. A possible conclusion from this finding is that lack of knowledge about the security policy may lead to unintentional disclosure of sensitive information. In the context of information security, human factors play a significant role. As demonstrated in research, an increased number of decisions can lead to more errors, such as falsely identifying incidents. Thus, educating employees about security protocols is vital.

However, it cannot be assumed that information security is not critical to all functions, nor can the auditor expect that the finding will automatically result in management providing continuous training. The most pragmatic step would be for the IS audit to recommend that the company implement policies for improving awareness and comprehension of the security policy, but suggesting that the IS audit should provide training is beyond the scope of their responsibilities.