The most important factor for the organization to ensure when reducing the retention period for media containing completed low-value transactions is that the retention period complies with data owner responsibilities. Data owners are accountable for defining the retention and disposal requirements for the data under their custody, based on business, legal, regulatory, and contractual obligations. The policy should reflect the data owner's decisions and obtain their approval. The policy should also include a risk-based approach, but this is not as important as complying with data owner responsibilities. The retention period should allow for review during the year-end audit, but this may not be necessary for low-value transactions that have minimal impact on financial reporting. The total transaction amount may have some impact on financial reporting, but this is not a direct consequence of reducing the retention period. References:
* CISA Review Manual, 27th Edition, pages 414-4151
* CISA Review Questions, Answers & Explanations Database, Question ID: 255

Although BCP and DRP are often implemented and tested by middle management and end users, the ultimate responsibility and accountability for the plans remain with executive management, such as the board of directors.

Section: Protection of Information Assets
Explanation/Reference:
Explanation:
An important means of controlling the spread of viruses is to detect the virus at the point of entry, before it
has an opportunity to cause damage. In an interconnected corporate network, virus scanning software,
used as an integral part of firewall technologies, is referred to as a virus wall. Virus walls scan incoming
traffic with the intent of detecting and removing viruses before they enter the protected network. The
presence of virus walls does not preclude the necessity for installing virus detection software on servers
and workstations within the network, but network- level protection is most effective the earlier the virus is
detected. Virus signature updating is a must in all circumstances, networked or not.