Chapter 1 Self Assessment Flashcards
Which of the following outlines the overall authority to perform an IS audit?
A. The audit scope with goals and objectives
B. A request from management to perform an audit
C. The approved audit charter
D. The approved audit schedule
C. The approved audit charter
The approved audit charter outlines the auditor’s responsibility, authority and accountability.
In performing a risk-based audit, which risk assessment is completed FIRST by an IS auditor?
A. Detection risk assessment B. Control risk assessment
C. Inherent risk assessment
D. Fraud risk assessment
C. Inherent risk assessment
Which of the following would an IS auditor MOST likely focus on when developing a risk-based audit program?
A. Business processes
B. Administrative controls
C. Environmental controls
D. Business strategies
A. Business processes
Which of the following types of audit risk assumes an absence of compensating controls in the area being reviewed?
A. Control risk
B. Detection risk
C. Inherent risk
D. Sampling risk
C. Inherent risk
The risk level or exposure without taking into account the actions that management has taken or might take is inherent risk.
An IS auditor performing a review of an application’s controls finds a weakness in system software that could materially impact the application. In this situation, an IS auditor should:
A. Disregard these control weaknesses because a system software review is beyond the scope of this review.
B. Conduct a detailed system software review and report the control weaknesses.
C. Include in the report a statement that the audit was limited to a review of the application’s controls.
D. Review the system software controls as relevant and recommend a detailed system software review.
D. Review the system software controls as relevant and recommend a detailed system software review.
The appropriate option would be to review the systems software as relevant to the review and recommend a detailed systems software review for which additional resources may be recommended.
Which of the following is the MOST important reason why an audit planning process should be reviewed at periodic intervals?
A. To plan for deployment of available audit resources
B. To consider changes to the risk environment
C. To provide inputs for documentation of the audit charter
D. To identify the applicable IS audit standards
B. To consider changes to the risk environment
Short- and long-term issues that drive audit planning can be heavily impacted by changes to the risk environment, technologies and business processes of the enterprise.
Which of the following is MOST effective for implementing a control self-assessment (CSA) within business units?
A. Informal peer reviews
B. Facilitated workshops
C. Process flow narratives
D. Data flow diagrams
B. Facilitated workshops
Facilitated workshops work well within business units.
Which of the following would an IS auditor perform FIRST when planning an IS audit?
A. Define audit deliverables.
B. Finalize the audit scope and audit objectives.
C. Gain an understanding of the business’s objectives and purpose.
D. Develop the audit approach or audit strategy.
C. Gain an understanding of the business’s objectives and purpose.
The approach an IS auditor should use to plan IS audit coverage should be based on:
A. risk.
B. materiality.
C. fraud monitoring.
D. sufficiency of audit evidence.
A. risk.
An organization performs a daily backup of critical data and software files and stores the backup tapes at an offsite location. The backup tapes are used to restore the files in case of a disruption. This is an example of a:
A. preventive control.
B. management control.
C. corrective control.
D. detective control.
C. corrective control.
While developing a risk-based audit program, on which of the following would the IS auditor MOST likely focus?
A. Business processes
B. Administrative controls
C. Operational controls
D. Business strategies
A. Business processes
A risk-based audit approach focuses on the understanding of the nature of the business
and being able to identify and categorize risk. Business risk impacts the long-term viability of a specific business. Thus, an IS auditor using a risk-based audit approach must be able to understand business processes.
In performing a risk-based audit, which risk assessment is completed INITIALLY by the IS auditor?
A. Detection risk assessment
B. Control risk assessment
C. Inherent risk assessment
D. Fraud risk assessment
C. Inherent risk assessment
Inherent risk exists independently of an audit and can occur because of the nature of the business. To successfully conduct an audit, it is important to be aware of the related business processes. To perform the audit, the IS auditor needs to understand the business process, and by understanding the business process, the IS auditor better understands the inherent risk.
The FIRST step in planning an audit is to:
A. define audit deliverables.
B. finalize the audit scope and audit objectives.
C. gain an understanding of the business’ objectives.
D. develop the audit approach or audit strategy.
C. gain an understanding of the business’ objectives.
The first step in audit planning is to gain
an understanding of the business’s mission, objectives and purpose, which in turn identifies the relevant policies, standards, guidelines, procedures and organization structure.
The approach an IS auditor should use to plan IS audit coverage should be based on:
A. risk.
B. materiality.
C. professional skepticism.
D. sufficiency of audit evidence.
A. risk.
ISACA IS Audit and Assurance Standard 1202, Planning, establishes standards and provides guidance on planning an audit. It requires a risk-based approach.
A company performs a daily backup of critical data and software files, and stores the backup tapes at an offsite location. The backup tapes are used to restore the files in case of a disruption. This is a:
A. preventive control.
B. management control.
C. corrective control.
D. detective control.
C. corrective control.
A corrective control helps to correct or minimize the impact of a problem. Backup tapes can be used for restoring the files in case of damage of files, thereby reducing the impact of a disruption.
