CISA Domain 1

Charles is developing an audit plan for his organization security operations center. Which of the following will help him to determine which controls needs to be looked in greater detail?

• Security Audit Logs

• Prior year audit results

• Risk Assessment report

• Performance (KPIs) of the center

What would type of control would a video surveillance system be classified as?

• Detective and deterrent

• Detective

• Deterrent

• Preventive

An organization outsources its payroll and expense reporting to a company that uses a SaaS based environment. The outsourcing company supports many other customers. Why kind of audit should the organization undertake?

• Compliance audit

• Operational audit

• Service organization audit

• IS audit

An audit project is taking too long and management is beginning to question its schedule and completion. This audit may be lacking:

• Effective project management

• Co-operation from auditees

• Skilled auditors

• Clearly defined scope and objectives

An auditor is auditing the user account request and fulfillment process. There are thousands of transactions and the auditor cannot view them all. The auditor wants to view a random selection of transactions. What is this called?

• Judgemental sampling

• Random sampling

• Stratified sampling

• Statistical sampling

A lead auditor is preparing an audit plan for a client's financial accounting system. The plan calls for periodic testing of a large number of transactions throughout the audit project. Which is the best approach

• Re-perform randomly selected transactions

• Periodically submit test transactions

• Develop a CAAT

• Request a list of transactions to analyze

Which of the following is NOT true?

• ISACA Audit Standards are mandatory

• ISACA Audit Standards and Guidelines are optional

• ISACA Audit Guidelines are not mandatory

• ISACA Audit Standards are not only mandatory for SOX audits

Why are preventive controls favored over detective controls?

• Preventive controls are easier to justify and implement

• Preventive controls are less expensive to implement

• Preventive controls stop unwanted events from happening

• Preventive controls stop and record unwanted events from occurring

For audit planning purpose, can an auditor rely upon the auditee's risk assessment?

• Yes the auditor can

• Yes, only if the risk assessment is done by a qualified third party

• No, the auditor needs to perform the risk assessment

• No as the audit plan development do not require a risk assessment

An auditor is auditing the user's account and fulfillment process and ask the control owner to describe the process. What type of auditing is taking place?

• Observation

• Document Review

• Walkthrough

• Corroborative inquiry