Section: Protection of Information Assets
Explanation:
Inadequate software baselining often results in project scope creep because functional requirements are
not defined as well as they could be.

Section: Protection of Information Assets
Explanation:
From an IS auditor's perspective, the primary objective of auditing the management of service providers
should be to determine if the services that were requested were provided in a way that is acceptable,
seamless and in line with contractual agreements. Minimizing costs, if applicable and achievable
(depending on the customer's need) is traditionally not part of an IS auditor's job. This would normally be
done by a line management function within the IT department.
Furthermore, during an audit, it is too late to minimize the costs for existing provider arrangements.
Subcontracting providers could be a concern, but it would not be the primary concern. Transferring
knowledge to the internal IT department might be desirable under certain circumstances, but should not be
the primary concern of an IS auditor when auditing IT service providers and the management thereof.

Explanation
The first course of action that the auditor should recommend after finding that several employees are spending an excessive amount of time using social media sites for personal reasons is to implement policies addressing acceptable usage of social media during working hours. Policies can help define the scope, purpose, rules, and expectations of using social media in the workplace, both for personal and professional reasons. Policies can also specify the consequences of violating the policies, such as disciplinary actions or termination. Policies can help deter employees from misusing social media at work, which could affect their productivity, performance, or security. Policies can also help protect the organization from legal liabilities or reputational damages that could arise from inappropriate or unlawful employee behavior on social media.

Section: Protection of Information Assets

Section: Protection of Information Assets