The greatest concern for an IS auditor evaluating the access controls for a shared customer relationship management (CRM) system is that audit logging is not enabled. Audit logging is a process that records and tracks the activities and events that occur on a system, such as who accessed what data, when, how, and why.
Audit logging can help monitor and verify the compliance and effectiveness of the access controls, as well as detect and investigate any unauthorized or suspicious access or actions. Audit logging can also provide evidence and accountability for the security and integrity of the system and the data.
Without audit logging, the IS auditor would not be able to audit the access controls for the shared CRM system, as there would be no reliable or traceable records of the access history or patterns. Without audit logging, the organization would also not be able to identify or respond to any potential breaches or incidents that may compromise the confidentiality, availability, or accuracy of the CRM data. Without audit logging, the organization would also not be able to demonstrate or prove itscompliance with any applicable policies, regulations, or standards that may require audit logging for CRM systems.
Single sign-on is not enabled is not a great concern for an IS auditor evaluating the access controls for a shared CRM system, but rather a potential improvement or enhancement. Single sign-on is a process that allows users to access multiple systems or applications with one set of credentials, such as a username and password. Single sign-on can help simplify and streamline the user experience, as well as reduce the risk of password fatigue or compromise. However, single sign-on is not a mandatory or essential requirement for access controls, and it may also introduce some challenges or risks, such as dependency on a single point of failure or vulnerability.
Security baseline is not consistently applied is not a great concern for an IS auditor evaluating the access controls for a shared CRM system, but rather a minor issue or gap. Security baseline is a set of minimum security standards or requirements that apply to a system or application, such as password policies, encryption protocols, or firewall rules. Security baseline can help ensure that the system or application meets a certain level of security and compliance. However, security baseline is not a sufficient or comprehensive measure for access controls, and it may also need to be customized or adjusted according to the specific needs and risks of each system or application.
Complex passwords are not required is not a great concern for an IS auditor evaluating the access controls for a shared CRM system, but rather a common practice or recommendation. Complex passwords are passwords that are composed of a combination of different types of characters, such as letters, numbers, symbols, and cases. Complex passwords can help prevent or deter brute-force attacks or guessing attempts by making the passwords harder to crack or predict. However, complex passwords are not a guarantee or guarantee of security, and they may also have some drawbacks or limitations, such as user inconvenience, memorability issues, or reuse across multiple systems or applications.
References:
Customer Relationship Management Risks and Controls - CRM Simplified 1
Customer relationship management: A guide - Zendesk 2
How to Protect Your Customer Relationship Management (CRM) Data from Hackers 3 What is CRM? | A Definition by Salesforce 4

The most important factor to consider when developing a service level agreement (SLA) is the description of the services from the viewpoint of the client organization, because the SLA shouldreflect the needs and expectations of the client and specify the measurable outcomes and performance indicators that the provider must deliver34. The description of the services from the viewpoint of the provider, the detailed identification of work to be completed, and the provisions for regulatory requirements that impact the end users' businesses are also important elements of an SLA, but not as crucial as the client'sperspective. References: 3: CISA Review Manual (Digital Version), Chapter 5, Section 5.3.1 4: CISA Online Review Course, Module 5, Lesson 3

The best way to reduce the risk of inaccurate or misleading data proliferating through business intelligence systems is to establish rules for converting data from one format to another, because this ensures that the data quality and integrity are maintained throughout the data transformation process. Data conversion rules define the standards, procedures, and methods for transforming data from different sources and formats into a common format and structure that can be used by the business intelligence systems12. Implementing data entry controls for new and existing applications, implementing a consistent database indexing strategy, and developing a metadata repository to store and access metadata are not the best ways to reduce the risk of inaccurate or misleading data proliferating through business intelligence systems, because they do not address the issue of data conversion, which is a critical step in the data integration process for business intelligence systems. References: 1: CISA Review Manual (Digital Version), Chapter 4, Section 4.3.3 2: CISA Online Review Course, Module 4, Lesson 3

Comprehensive and Detailed Step-by-Step Explanation:
Toverify the effectivenessof a third-party provider'ssecurity controls, anindependent external audit reportis thestrongestevidence.
* Option A (Incorrect):Security configuration documentsare helpful butdo not confirm effectivenesswithout validation.
* Option B (Incorrect):Policies and procedures outlineintent, but anaudit confirms actual implementation.
* Option C (Correct):External audit reports (e.g., SOC 2, ISO 27001)provideindependent assurancethat security controls are effective.
* Option D (Incorrect):Management interviews providequalitativeinsights but arenot objective evidenceof control effectiveness.
Reference:ISACA CISA Review Manual -Domain 3: Information Systems Acquisition, Development, and Implementation- Coversthird-party risk assessments and audit assurance.