1: Risk Assessment

Question 1

What are the elements of risk

Answer 1

Probability &; Impact

Vulnerability &; Threat

Question 2

What is risk formula

Answer 2

Risk = Probability X Impact
or
Risk = Asset Value X Vulnerability X Threat

Question 3

What is vulnerability

Answer 3

Vulnerability means weak or defenseless

Question 4

What is a threat

Answer 4

Threat means something that can exploit the weakness

Question 5

Is there a treat for a useless system?

Answer 5

Even though vulnerability is high for a useless system, there is no threat

Question 6

Steps of Risk assessment

Answer 6

1- Identify critical Assets/Processes.
2- Identify relevant risks (Vulnerability and threat)
3-Do Impact Analysis (qualitative and quantitative)
4- Risk Prioritization
5-Risk Treatment

Question 7

Question:
IS Auditor identified certain threats and vulnerabilities in a business process. Next, an IS auditor
should:

A. identify stakeholder for that business process.
B. identify information assets and the underlying systems.
C. disclose the threats and impacts to management.
D. identify and evaluate the existing controls.

Answer 7

Answer

C. disclose the threats and impacts to management.

Question 8

Avoid confusion between Threat and vulnerability

Answer 8

1- A threat is what we’re trying to protect against. Threats are not in our control.

2- Vulnerability is a weakness or gap in our protection efforts. Vulnerabilities can be controlled by us.

Question 9

Question:
Absence of proper security measures represents a (n):
A. threat.
B. asset.
C. impact.
D. vulnerability.

Answer 9

Answer :

D. vulnerability.

Question 10

Type of Risk

Answer 10

Inherent
Residual
Detection
Control

Question 11

Inherent Risk

Answer 11

Risk that an activity poses if no controls factors were in place,

Question 12

Residual Risk

Answer 12

The risk that remains after controls are taken into account (net risk or risk after controls).

Question 13

Detection risk

Answer 13

Detection risk is the possibility that an auditor will overlook errors or exceptions during an audit. Detection risk should carried at the beginning of risk assessment.

Question 14

Control risk

Answer 14

Control risk is the probability that financial statements are materially misstated, due to failures in the system of controls used by a business

Question 15

Audit risk

Answer 15

The risk that the financial statements are materially incorrect, even though the audit opinion states that the financial reports are free of any material misstatements

Question 16

Audit Risk Formula

Answer 16

Audit Risk = Inherent Risk X Control Risk X Detection Risk

Question 17

Risk treatement

Answer 17

• Risk Mitigation/Risk Reduction
• Risk Avoidance
• Risk Acceptance
• Risk Transfer