Ch 2 Flashcards
Name some soft skills
Honest Ethical Attention to detail Professionalism Listening Leadership
Name some hard skills
Technical competence Knowledge needed to accomplish work writing Thinking Project Mgmt Critical Thinking
Honest
soft
Ethical
soft
Attention to detail
soft
Verbal and written skill
Hard
Analytic skill
Hard
Interpersonal skill
Soft
Professional and willingness to take lead
Soft
Project management and Organizational skill
Hard
Critical Thinking
Hard
Professional Ethics describe
principles and values that govern acceptable behaivor
What does client mean
Leadership of the area you are auditing
CISA auditors must be
Honest and Transparent
Define Standards
Mandatory actions, Explicit Rules or Controls designed to support and conform to policy through hardware, software or behaivor
What makes policy more meaningful and effective
Standards
Standards should always point to
Policy
Procedures are
Written steps to execute policy
Which one is more detailed Policy or Procedures?
Procedures
What is an outline for a statement of conduct
Guideline
Are guidelines mandatory to follow
No
Do guidelines provide general guidance
Yes
Are guidelines Requirements that need to met or are they recommended
Recommended
Whats a baseline
specific rules that are accepted across the industry as providing the most effective approach to a specific implementation
Name some regulatory standards
HIPPA SOX Base III PCI FISMA COSO SCADA FACTA
HIPPA
Healthcare
SOX
Financial
Base III
Risk Mgmt Bankin
PCI
Credit Cards
FISMA
US Govt Security Standards
COSO
Financial Fraud Reporting
SCADA
Security for Automated Systems
FACTA
Reduce Fraud and ID Theft
Is regulatory guidance early, on time, or late
Late
Most cyber laws are written before or after a major breach
After
Name some industry guidance organizations
COBIT
ISO
NIST
FIPS
Name the types of audits
Financial
Integrated
Operational
What is a financial audit
Audit of financial statements and processes. Usually doesn’t include the IT auditor
Integrated Audit
Includes a financial and technical audit
What are the key risk types
Inherent
Control
Detection
Define Detection Risk
Misstatements or material errors have occurred and were not detected
What is an inherent risk
Naturally occurring risk because of the nature of business before controls are applied
Describe a control risk
Risk that internal controls will not prevent a material error
How does ISACA define material
Item of significance that has a real impact on the organization
Given the nature of driving, would no speed limits be an inherent risk
Yes
What type of risk is it if your dirver airbag does not deploy
It is a control risk
What type of risk is an audit
Detection risk
Is an audit a type of detection risk?
Yes
What is a risk that is (Inherent Risk - Controls)
Residual risk
What is left up to the professional opinion of the auditor
Quantitative analysis and qualitative judgement
What is quantative analysis
Conclusion based on a series of measurements
What is a qualitative judgement
Judgment based on a broad understanding of business and asks the question what might go wrong
What is risk mangaement
Identifying, assessing, mitigating and montioring risks
What is the risk management process
Implement a risk mgmt program ID Assests ID threats Perform risk analysis Disposition risk Montior
Is Risk mgmt a part of corporate governance
Yes
Who supports and funds risk mgmt
Senior Leadership
The risk mgmt leader should have good Project mgmt skills
Yes
What are the risk courses of action
Avoid
Reduce
Accept
Transfer
Is monitoring risk important
Yes
Why are controls used
To comply with internal policies, regulatory expectations and reduce risk
What is risk tolerance
Right controls to reduce risk to an acceptable level
Audited systems must meet which requirement
Regalatory and legal requirements
Do controls typically start with hihg-level policy and applies to all areas of the company
Yes
Name the two categories of procedures
General Control Procedures
IS Control Procedures
Controls are what
Preventative, Detective, Corrective
Name a preventative control
Access Control List
Name a detective control
IDS
Security Log
Name a corrective control
IPS
Backup Power Supply
What type of control stops a threat immediately
Preventative
What tyoe of control identifies a threat after the fact
Detective
What type of control tries to remediate the risk of a threat after the fact?
Corrective
Who has a fiduciary responsibility of special trust and confidence with the client
The auditor
What is the purpose of an IS audit
To evaluate controls against a predetermined control objectives
Audit Methodology
Documented approach for performing an audit in a consistent and repeatable manner
How does an audit methodology meet the audit objectives
By defingin the following:
Statement of Work
Statement of Scope
Statement of Audit Objectives
Name the steps of the audit process
Audit Subjects Audit Objective Audit Scope Pre Audit Planning Data Gathering Evaluation of test results Communication with management Preparation of audit report
In chain of custody, an auditor must be able to…
Account for who had access to the data
Ensure that access to the data is controlled
Show that the information was protected from tampering
What is evidence handling
Handling of any information obtained during the audit
Audit evidence should be
Sufficient Usable Reliable Relevant Effective
Give examples of work papers
Findings
Activities
Tests
Work Papers should be properly dated, labled, detailed, clear alnd self contained
Yes
What provides confidentiality for Work Papers
Encryption
What provides availability for work papers
Backups
What provides authorized access for work papers
Access control lists
What should be considered for electronic work papers
Encryption
Access lists
Backups
Audit trails and controls
Software audit tools used for statistical sampling and data analysis
Computer assisted audit tools
Sampling produces…
Generalized results for the population as a whole
What are some sampling methods
Statistical
Non Statistical
Variable
Attribute
What are teh parts of attribute sampling
Frequency estimating
Stop and Go
Discovery
What are a few ways to ensure compliance
Sampling or Monitoring
Continuous monitoring is good for which types of processes
Processes that capture, manipulate, store and disseminate data
What are the six preconditions that should be present before an org can adopt continuous auditing
System must have acceptable characteristics
System must be reliable, have existing controls and collect data on the systems
System must have a highly automated secondary control system
Auditor must be proficient in the technology
Audit Process must offer a reliable method for obtaining the audit procedure results
Verifiable controls of the audit reporting process must exist
QA strives to improve two key attributes
Quality and adherence
Best way to avoid surprises
Communicate Communicate Communicate
Name the four opinions that an auditor can have
Unqualified
Qualified
Adverse
Disclaimer
Opinions can be applied to what
Entire report or single finding
What are the three types of audit ratings
Unrated
Satisfactory
Unsatisfactory
