How would an IS auditor BEST determine the effectiveness of a security awareness program?

Social engineering tests are the most effective way toassess real-world security awarenessby measuring employees ' ability to recognize and resist security threats.

Review the Results of Social Engineering Tests (Correct Answer – A)

Simulated phishing attacks and pretexting exercises measure actual employee behavior.

Provides actionable insights into weaknesses in security awareness.

Example:If employees frequently click on phishing emails, the awareness program is ineffective.

Evaluate Management Survey Results (Incorrect – B)

Management perception is subjective and does not reflect actual employee behavior.

Interview Employees (Incorrect – C)

Employees may provide inaccurate or rehearsed responses.

Review Security Training Quiz Results (Incorrect – D)

Tests knowledge but does not measure practical application.