CISA PART-1

Which of the following outlines the overall authority to perform an IS audit?

• The audit scope, with goals and objectives

• A request from management to perform an audit

• The approved audit charter

• The approved audit schedule

Answer explanation

The approved audit charter outlines the auditor’s responsibility, authority and accountability.

In performing a risk-based audit, which risk assessment is completed INITIALLY by the IS auditor?

• Detection risk assessment

• Control risk assessment

• Inherent risk assessment

• Fraud risk assessment

Answer explanation

Inherent risk exists independently of an audit and can occur because of the nature of the business. To successfully conduct an audit, it is important to be aware of the related business processes. To perform the audit, the IS auditor needs to understand the business process, and by understanding the business process, the IS auditor better understands the inherent risk.

While developing a risk-based audit program, on which of the following would the IS auditor MOST likely focus?

• Business processes

• Administrative controls

• Operational controls

• Business strategies

Answer explanation

A risk-based audit approach focuses on the understanding of the nature of the business and being able to identify and categorize risk. Business risk impacts the long-term viability of a specific business. Thus, an IS auditor using a riskbased audit approach must be able to understand business processes.

Which of the following types of audit risk assumes an absence of compensating controls in the area being reviewed?

• Control risk

• Detection risk

• Inherent risk

• Sampling risk

Answer explanation

The risk level or exposure without taking into account the actions that management has taken or might take is inherent risk.

An IS auditor performing a review of an application’s controls finds a weakness in system software that could materially impact the application. The IS auditor should:

• disregard these control weaknesses because a system software review is beyond the scope of this review.

• conduct a detailed system software review and report the control weaknesses.

• include in the report a statement that the audit was limited to a review of the application’s controls.

• review the system software controls as relevant and recommend a detailed system software review.

Answer explanation

The appropriate option would be to review the systems software as relevant to the review and recommend a detailed systems software review for which additional resources may be recommended

Which of the following is the MOST important reason why an audit planning process should be reviewed at periodic intervals?

• To plan for deployment of available audit resources

• To consider changes to the risk environment

• To provide inputs for documentation of the audit charter

• To identify the applicable IS audit standards

Answer explanation

Short- and long-term issues that drive audit planning can be heavily impacted by changes to the risk environment, technologies and business processes of the enterprise

Which of the following is MOST effective for implementing a control self-assessment (CSA) within business units?

• Informal peer reviews

• Facilitated workshops

• Process flow narratives

• Data flow diagrams

Answer explanation

Facilitated workshops work well within business units.

The FIRST step in planning an audit is to:

• define audit deliverables.

• finalize the audit scope and audit objectives.

• gain an understanding of the business’ objectives.

• develop the audit approach or audit strategy.

Answer explanation

The first step in audit planning is to gain an understanding of the business’s mission, objectives and purpose, which in turn identifies the relevant policies, standards, guidelines, procedures and organization structure.

The approach an IS auditor should use to plan IS audit coverage should be based on:

• risk.

• materiality.

• professional skepticism.

• sufficiency of audit evidence.

Answer explanation

ISACA IS Audit and Assurance Standard 1202, Planning, establishes standards and provides guidance on planning an audit. It requires a risk-based approach.

A company performs a daily backup of critical data and software files, and stores the backup tapes at an offsite location. The backup tapes are used to restore the files in case of a disruption. This is a:

• preventive control.

• management control.

• corrective control.

• detective control.

Answer explanation

A corrective control helps to correct or minimize the impact of a problem. Backup tapes can be used for restoring the files in case of damage of files, thereby reducing the impact of a disruption.