CISA - 1

Which of the following tests is an IS auditor performing when a sample of programs is selected to determine if the source and object versions are the same?

• A substantive test of program library controls

• A compliance test of program library controls

• A compliance test of the program compiler controls

• A substantive test of the program compiler controls

Which of the following systems-based approaches would a financial processing company employ to monitor spending patterns to identify abnormal patterns and report them?

• A neural network

• Database management software

• Management information systems

• Computer assisted audit techniques

What is the primary objective of a control self-assessment (CSA) program?

• Enhancement of the audit responsibility

• Elimination of the audit responsibility

• Replacement of the audit responsibility

• Integrity of the audit responsibility

What is the PRIMARY purpose of audit trails?

• To document auditing efforts

• To correct data integrity errors

• To establish accountability and responsibility for processed

  transactions

• To prevent unauthorized access to data

How does the process of systems auditing benefit from using a risk-based approach to audit planning?

• Controls testing starts earlier

• Auditing resources are allocated to the areas of highest concern

• Auditing risk is reduced

• Controls testing is more thorough

The use of statistical sampling procedures helps minimize:

• Detection risk

• Business risk

• Controls risk

• Compliance risk

What type of risk results when an IS auditor uses an inadequate test procedure and concludes that material errors do not exist when errors actually exist?

• Business risk

• Detection risk

• Residual risk

• Inherent risk

A primary benefit derived from an organization employing control self- assessment (CSA) techniques is that it can:

• Identify high-risk areas that might need a detailed review later

• Reduce audit costs

• Reduce audit time

• Increase audit accuracy

Who is ultimately accountable for the development of an IS security policy?

• The board of directors

• Middle management

• Security administrators

• Network administrators

An IS auditor usually places more reliance on evidence directly collected. What is an example of such evidence?

• Evidence collected through personal observation

• Evidence collected through systems logs provided by the

  organization's security administration

• Evidence collected through surveys collected from internal staff

• Evidence collected through transaction reports provided by the

  organization's IT administration