M1C12

The primary purpose and existence of an audit charter is to:

• Document the audit process used by the enterprise.
• Formally document the audit department’s plan of action.
• Document a code of professional conduct for the auditor.
• Describe the authority and responsibilities of the audit department.

Answer explanation

It is like the constitution for the IS Audit function as it mandates the authority, scope and responsibility of IS Audit in the organization.

Which of the following control classifications identify the cause of a problem and minimize the impact of threat

• Administrative Controls
• Detective Controls
• Preventive Controls
• Corrective Controls

Answer explanation

Corrective Controls classifications identify the cause of a problem and minimize the impact of threat. The Goal of these controls is to identify the root cause of an issue whenever possible and eliminate the potential for that occurring again. The other controls are useful but perform other functions instead.

Which of the following is NOT generally considered a category of Audit Risk?

• Detection Risk
• Scoping Risk
• Inherent Risk
• Control Risk

Answer explanation

Scoping risk is not generally considered as category of audit risk. The other risk categories are also possible types of risk; however they are not the one that question demand.

Which of the following are most commonly used to mitigate risks discovered by organizations?

• Controls
• Personnel
• Resources
• Threats

Answer explanation

Controls are most commonly used to mitigate risks discovered by organizations. This is what organizations implement as a result of the risks an organization discovers. Resources and personnel are often expended to implement controls.

Which of the following is not a type of internal controls

• Detective
• Corrective
• Preventive
• Administrative

Answer explanation

Administrative is not a type of internal controls. Detective is designed to detect errors or irregularities that may have occurred. Corrective is designed to correct errors or irregularities that have been detected. Preventive is designed to keep errors or irregularities from occurring.

What means the rate at which opinion of the IS Auditor would change if he selects a larger sample size?

• Audit Risk
• Materiality
• Risk Based Audit
• Controls

Answer explanation

Audit risk means the rate at which opinion of the IS Auditor would change if he selects a larger sample size. Audit risk can be high, moderate or low depending on the sample size selected by the IS Auditor. A risk based audit approach is usually adapted to develop and improve the continuous audit process. Materiality means importance of information to the users. It is totally the matter of the professional judgment of the IS Auditor to decide whether the information is material or immaterial.

Which of the following cannot be classified as Audit Risk?

• Inherent Risk
• Detection Risk
• Controllable Risk
• Administrative Risk

Answer explanation

Inherent risk means overall risk of management which is on account of entity’s business operations as a whole. Controllable risk is the risk present in the internal control system and the enterprise can control this risk completely and eliminate it form the system. Detection risk is the risk of the IS Auditor when he is not able to detect the inherent risk or the controllable risk.

After you enter a purchase order in an on-line system, you get the message, “The request could not be processed due to lack of funds in your budget”. This is an example of error?

• Detection
• Correction
• Prevention
• Recovery

Answer explanation

To stop or prevent a wrong entry is a function of error prevention . Rest all options work after an error. Prevention works before an occurring of error.

When developing a risk-based audit strategy, an IS auditor should conduct a risk assessment to ensure that:

• controls needed to mitigate risks are in place.
• vulnerabilities and threats are identified.
• audit risks are considered.
• a gap analysis is appropriate

Answer explanation

In developing a risk-based audit strategy, it is critical that the risks and vulnerabilities be understood. This will determine the areas to be audited and the extent of coverage. Understanding whether appropriate controls required to mitigate risks are in place is a resultant effect of an audit. Audit risks are inherent aspects of auditing, are directly related to the audit process and are not relevant to the risk analysis of the environment to be audited. Gap analysis would normally be done to compare the actual state to an expected or desirable state.

Reviewing management's long-term strategic plans helps the IS auditor:

• Gains an understanding of an organization's goals and objectives.
• Tests the enterprise's internal controls.
• Assess the organization's reliance on information systems.
• Determine the number of audit resources needed.

Answer explanation

Strategic planning sets corporate or departmental objectives into motion. Strategic planning is time- and project-oriented, but must also address and help determine priorities to meet business needs. Reviewing long-term strategic plans would not achieve the objectives expressed by the other choices.