An internal audit function reports administratively to the CEO but functionally to the Audit Committee. The primary benefit is:

• Faster budget approvals for audit tools

• Stronger independence with oversight aligned to governance expectations

• Less interaction with executive management

• Reduced need for audit evidence

Which set best reflects data/transaction control objectives across input–processing–output?

• Authentication, encryption, hashing

• Accuracy, completeness, authorization, and proper audit trail

• Efficiency, effectiveness, scalability

• Identification, classification, disposal

An IS auditor reviews the control environment. Which observation most strongly indicates a healthy environment?

• Informal role descriptions to increase flexibility

• Documented structure with clear authority limits and SoD

• One super-user account for all administrators

• Ad-hoc policies maintained by teams

In manual vs. automated systems, the risk most uniquely elevated in on-line, real-time processing is:

• Availability and concurrency control

• Optical character recognition error

• File label mismatch on tapes

• Misfiled paper vouchers

The IS internal audit objective that most directly links to management assurance is to:

• Design and implement controls

• Express an opinion supported by sufficient, competent, relevant, and useful evidence

• Approve business strategies

• Negotiate vendor contracts

Which pair most accurately matches preventive vs. detective application controls?

• Limit check vs. batch exception report

• Reconciliation vs. edit check

• After-the-fact approval vs. field validation

• Logging vs. encryption

When compensating controls are acceptable, the auditor’s focus should be on:

• Whether the compensating control fully duplicates the original design

• Whether residual risk is reduced to an acceptable level and is sustainable

• Whether compensating control is cheaper

• Whether it is manual rather than automated

In a risk-based IS audit plan, which factor most increases systems risk score?

• Highly stable system with low monetary throughput

• High monetary values, high confidentiality, and high impact of disruption

• Complex tech but zero regulatory exposure

• No external interfaces

The strongest evidence of effective program change control in production is:

• Email approvals saved by the developer

• Digitally signed, system-enforced workflow logs with time-stamps and release gates

• A weekly release calendar alone

• A retrospective verbal sign-off

In audit reporting, the section most likely read by senior executives and must emphasize risk/impact is the:

• Appendices

• Detailed findings

• Executive summary

• Formalities section