Question 73

Explanation

Correct Answer: C. Results of the risk management process. Explanation: When evaluating the adequacy of an organization's information security policy, the best source of information for an IS auditor is the results of the risk management process. Risk management helps identify and assess potential risks to the organization's information assets and determines appropriate controls to mitigate those risks. By reviewing the results of the risk management process, the auditor can understand the specific risks identified and the controls implemented to address those risks. This information is crucial in assessing the adequacy and effectiveness of the organization's information security policy. Option A, industry best practices, can provide valuable insights and benchmarks for developing an information security policy. However, it may not necessarily reflect the organization's unique risk profile and requirements. Internal audit reports (option B) can provide additional information about the organization's control environment but may not specifically address the adequacy of the information security policy. Employee surveys (option D) can capture subjective opinions and perceptions but may not provide comprehensive and objective evidence about the policy's adequacy. In summary, when determining the adequacy of an organization's information security policy, the best source of information for an IS auditor is the results of the risk management process (option C). It provides insight into the identified risks and corresponding controls, allowing the auditor to evaluate the policy's alignment with the organization's risk profile.