Certified Information Systems Auditor (CISA) — Question 1404

Due to limited storage capacity, an organization has decided to reduce the actual retention period for media containing completed low-value transactions. Which of the following is MOST important for the organization to ensure?

Answer options

• A. The policy includes a strong risk-based approach.
• B. The retention period complies with data owner responsibilities.
• C. The retention period allows for review during the year-end audit.
• D. The total transaction amount has no impact on financial reporting.

Correct answer: B

Explanation

The correct answer is B, as it ensures that the organization adheres to compliance requirements regarding data ownership, which is critical in managing data retention. Options A and C, while important, do not focus directly on compliance with data owner responsibilities. Option D is irrelevant, as it does not pertain to retention policies or compliance.