CIMA Exam CIMAPRO19-P03-1 Topic 1 Question 81 Discussion

Actual exam question for CIMA's CIMAPRO19-P03-1 exam

Question #: 81
Topic #: 1

KLO is a major quoted car rental company The company is considering publishing its first cyber risk management report

AH rental bookings are made online Customers receive a booking reference number that they use to collect their cars from a convenient branch Customers enter their credit card details both so that KLO can take payment for their rental and also so that the customers can be charged automatically for late returns or damage to cars

KLO's management believes that it has three key areas of cyber risk Cyber criminals may wish to make bookings using fictitious data in order to steal KLO's cars, they may wish to use customers details to identify addresses of people who are away from home so that they can burgle houses and they may wish to abuse customer credit card details

KLO's Board is concerned that admitting to the nsk of stealing cars might encourage cnminals to exploit that vulnerability AJso. it is concerned that customers will be reluctant to rent cars if that would mean that their homes could be at risk of burglary while they are away The vulnerability of credit card details seems obvious and so the Board is not reluctant to admit to that.

Which TWO of the following are correct?

AThe Board should be clear about all sensitive information that the company holds, but should also be clear about the robust controls in place to safeguard that information.

BIf KLO's Board omits one of more areas of concern from the report then the independent accountant who will sign the report is unlikely to discover that omission

CThe independent accountant who will express an opinion on the risks and controls will be unwilling to sign the report unless it contains a full account of all risks and controls

DThe independent accountant's report on KLO's cyber risk management will refer only to those vulnerabilities that have been identified by KLO's Board

EStakeholders will not care about the vulnerabilities faced by KLO provided the independent accountant can confirm that the company has sound systems in place

Show Suggested Answer

Suggested Answer: A, C

by Layla at Sep 18, 2024, 03:40 AM

Limited Time Offer

25%

Off

Get Premium CIMAPRO19-P03-1 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Iluminada

20 days ago

I bet the accountant will be signing the report with one hand while holding a baseball bat in the other, just in case the Board tries any funny business.

upvoted 0 times

...

26 days ago

E is just ridiculous. Stakeholders will definitely care about the vulnerabilities. A and C are the way to go.

upvoted 0 times

Kara

10 days ago

I agree, stakeholders will definitely care about the vulnerabilities.

upvoted 0 times

...

1 months ago

I agree with A, but I'm not sure about C. Surely the accountant can't force the Board to disclose something they're not comfortable with.

upvoted 0 times

Louvenia

5 days ago

But can the accountant really force the Board to disclose everything they're uncomfortable with?

upvoted 0 times

...

Jeannetta

8 days ago

The independent accountant may not sign off on the report if it doesn't cover all risks and controls.

upvoted 0 times

...

Shanice

9 days ago

I agree, it's important for stakeholders to know how the company is safeguarding their data.

upvoted 0 times

...

Maybelle

1 months ago

I think the Board should be transparent about all sensitive information and also highlight the controls in place.

upvoted 0 times

...

Delila

2 months ago

A and C seem like the correct answers. The Board should be transparent about the risks, and the independent accountant should require a full account of the risks and controls.

upvoted 0 times

Domonique

1 months ago

C) The independent accountant who will express an opinion on the risks and controls will be unwilling to sign the report unless it contains a full account of all risks and controls

upvoted 0 times

...

Major

2 months ago

A) The Board should be clear about all sensitive information that the company holds, but should also be clear about the robust controls in place to safeguard that information.

upvoted 0 times

...