Explanation/Reference:
Explanation:
A bottom-up approach to the development of organizational policies is often driven by risk assessment.

Section: Protection of Information Assets
Explanation:
Plans are important, but mere plans do not provide reasonable assurance unless tested. References for the alternate site provider and the existence and maintenance of a disaster recovery plan are important, but only tests and drills demonstrate the adequacy of the plans and provide reasonable assurance of an organization's disaster recovery readiness.

Section: The process of Auditing Information System

Explanation/Reference:
Explanation:
Instead of simply reviewing the effectiveness and utilization of assets, an IS auditor is more concerned with adequate access control, appropriate access policies, and effectiveness of safeguards and procedures.

Section: Protection of Information Assets
Explanation:
The use of statistical sampling procedures helps minimize detection risk.