CISA Quiz

Which of the following is the FIRST step performed prior to creating a risk ranking for the annual internal IS audit plan?

• 
  Prioritise the identified risk.

• Define the audit universe.

• Identify the critical controls.

• 
  Determine the testing approach.

Which of the following is the MOST critical step when planning an IS audit?

• 
  Review findings from prior audits.

• Executive management's approval of the audit plan.

• Review IS security policies and procedures.

• Perform Risk Assessment

The PRIMARY advantage of a continuous audit approach is that it:

• Does not require an IS auditor to collect evidence on system reliability while processing is taking place

• Requires the IS auditor to review and follow up immediately on all information collected

• Can improve system security when used in time-sharing environments that process a large number of transactions

• 
  Does not depend on the complexity of an organizations computer systems.

An IS Auditor is performing an audit of a remotely managed server backup. The IS Auditor reviews the log for one day and finds one case where logging on a server has failed with the result that backup restarts can not be confirmed. What should the auditor do?

• Issue an Audit finding

• Seek an explanation from IS management

• Review the classification of data held on the server

• Expand the sample of logs reviewed

During the planning stage of an IS Audit, the PRIMARY goal of an IS Auditor is to:

• Address Audit objectives

• 
  Collect sufficient evidence

• Specify appropriate tests

• Minimize audit resources

Overall business risk for particular threat can be expressed as:

• A Product of probability and magnitude of impact if threat successfully exploits the vulnerability

• 
  The magnitude of impact should a threat source successfully exploit the vulnerability

• The likelihood of given threat source exploiting a given vulnerability

• The collective judgement of the risk assessment team

hich of the following is NOT a function of the audit working papers

• 
  Show compliance with standards

• Show how results were deduced

• 
  Show management’s role

• 
  Show due care was exercised

Which of the following is NOT part of the audit report?

• 
  Time frame for audit

• 
  Audit Scope

• Purpose and Objective

• Expectation and obligation of client and auditor

In a follow-up audit, an IS auditor notes that management has addressed the original findings in a different way than originally agreed upon. The auditor should FIRST:

• 
  mark the recommendation as satisfied and close the finding

• 
  verify if management's action mitigates the identified risk

• 
  re-perform the audit to assess the changed control environment

• escalate the deviation to the audit committee

An IS audit team is evaluating the documentation related to the most recent application user-access review performed by IT and business management. It is determined the user list was not system-generated. Which of the following should be the GREATEST concern?

• Source of the user list reviewed

• 
  Availability of the user list reviewed

• 
  Confidentiality of the user list reviewed

• Completeness of the user list reviewed