The most important determining factor when establishing appropriate timeframes for follow-up activities related to audit findings is the remediation dates included in management responses. The IS auditor should ensure that the follow-up activities are aligned with the agreed-upon action plans and deadlines that management has committed to in response to the audit findings. The follow-up activities should verify that management has implemented the corrective actions effectively and in a timely manner, and that the audit findings have been resolved or mitigated.
The other options are less important factors for establishing timeframes for follow-up activities:
Availability of IS audit resources. This is a practical factor that may affect the scheduling and execution of follow-up activities, but it should not override the priority and urgency of verifying management's corrective actions.
Peak activity periods for the business. This is a factor that may affect the availability and cooperation of auditees during follow-up activities, but it should not delay or postpone the verification of management's corrective actions beyond reasonable limits.
Complexity of business processes identified in the audit. This is a factor that may affect the scope and depth of follow-up activities, but it should not affect the timeframe for verifying management's corrective actions.

Providing security certification for a new system should include an evaluation of the configuration management practices prior to the system's implementation. Configuration management is a process that ensures that the system's components are identified, controlled, and tracked throughout the system's lifecycle.
Configuration management helps to maintain the security and integrity of the system by preventing unauthorized or unintended changes. End-user authorization to use the system in production is not part of security certification, but rather a post-implementation activity that grants access rights to authorized users.
External audit sign-off on financial controls is not part of security certification, but rather a verification activity that ensures that the system complies with financial reporting standards. Testing of the system within the production environment is not part of securitycertification, but rather a validation activity that ensures that the system meets the functional and performance requirements. References:
CISA Review Manual, 27th Edition, pages 449-4501
CISA Review Questions, Answersand Explanations Database, Question ID: 2572

If the audit team lacks the necessary knowledge to audit a system that uses an AI algorithm, engaging external consultants who have audit experience and knowledge of AI would be the best approach12. These consultants can provide the expertise needed to effectively audit the AI system12. This approach ensures that the audit is conducted thoroughly and accurately, without requiring the audit team to acquire new skills or knowledge12.
References:
Auditing Guidelines for Artificial Intelligence - ISACA
An In-Depth Guide To Audit AI Models - Censius

AnIT strategymust bealigned with business objectives, not solely based onmarket trends.
Strategic IT Goals Derived Solely from Market Trends (Correct Answer - D) IT strategy should supportorganizational goals, not justfollow industry trends.
Example:A company investing inAIjust because it'strendy, without considering business needs.
Previous Year's IT Goals Not Achieved (Incorrect - A)
A concern, butdoes not indicate a fundamental strategy flaw.
Target Architecture Defined at a Technical Level (Incorrect - B)
Technical details are important for implementation.
Financial Estimates Included (Incorrect - C)
Cost transparency is agood practice.
References:
ISACA CISA Review Manual
COBIT 2019 (IT Governance)

Enterprise Architecture (EA) documentation primarily includes strategic and operational blueprints outlining the evolution of IT infrastructure to align with business goals. Roadmaps showing the evolution from current state to future state (C) are essential for understanding how the organization's IT environment will change over time to support business strategy.
Other options:
Contact information for key resources (A) is more of an operational or administrative document rather than an EA component.
Detailed encryption standards (B) would typically be found in security policies or system-specific documentation rather than in EA documentation.
Protocols used to communicate between systems (D) are typically documented within network or system architecture diagrams rather than high-level EA documentation.
Reference: ISACA CISA Review Manual, IT Governance and Management of IT