Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 4.0 - ISACA > CISA Concepts > Flashcards

CISA Concepts Flashcards

1
Q

What is the definition of audit?

A

Auditing is a detailed and specific evaluation of a process, procedure, organization, job function, or system, in which results are gathered and reported.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the purpose of ethics?

A

To mandate the professional and personal conduct of auditors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

According to the ISACA Code of Ethics is an auditor allowed to share the results of an audit with other personnel?

A

The auditor must maintain confidentiality of the audit unless required by legal authority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Should the IS audit plan be integrated into the overall audit plan for the organization?

A

The IS Audit function must fulfill all organizational audit objectives.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

An IS Auditor is best advised to follow the standards provided by ISACA for conducting an planning IS Audits

A

ISACA audit standards are recommendations for planning IS audits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISACA Audit standard S2 Independence refers to what?

A

An Auditor should be independent of the area being audited

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Standard S4 Professional Competence, requires the auditor to have the skills to conduct the audit?

A

appropriate continuing professional education

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The basis for an audit plan should be what?

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Audit findings and conclusions are supported by what?

A

Evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

When an auditor uses the assistance of outside experts, what obligations does the auditor have to review the work of the experts?

A

The auditor must apply additional test procedures if the work of outside experts is not adequate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When an auditor is planning an information system audit and suspects a potential control weakness, what are they obligated to do?

A

The auditor must consider the materiality of the weakness and plan the audit accordingly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What role does risk assessment have in audit planning?

A

Risk assessment is used to determine the priorities for audit and allocation of audit resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What steps should an auditor take when a material irregularity is discovered?

A

The auditor should communicate the irregularity to management in a timely manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the risk to an audit if unusual relationships exist between staff members in the area being audited?

A

The auditor may be provided inaccurate evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or False? Supervision of the information systems audit staff should not be necessary if the staff is adequately trained and experienced

A

TRUE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Once an audit is completed and submitted does the auditor have any further responsibility?

A

Yes, the auditor should follow up to ensure that management addressed any audit issues in a timely manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

IT governance means:

A

The IT function aligns with business mission, values and objectives

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Relationships with third parties may:

A

Require the organization to comply with the security standards of the third party

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or False? The organization does not have to worry about the impact of third party relationships on the security program

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The role of an Information Systems Security Steering Committee is to:

A

Provide feedback from all areas of the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The most effective tool a security department has is:

A

A security awareness program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The role of Audit in relation to Information Security is:

A

The validate the effectiveness of the security program against established metrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Who should be responsible for development of a risk management strategy?

A

The Security Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

The security requirements of each member of the organization should be documented in:

A

Their job descriptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What could be the greatest challenge to implementing a new security strategy?

A

Obtaining buy-in from employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which forms of wireless media operate only when there are no obstacles in the transmission path?

A

Spread spectrum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What best defines electrical noise?

A

Extraneous signals introduced onto network media.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

An audit log is an example of a:

A

Detective control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

A compensating control is used:

A

When normal controls are not sufficient to mitigate the trick

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

A disgruntled former employee is a:

A

Threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

A bug or software flaw is a:

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Encryption is an example of a:

A

Countermeasure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

The examination of risk factors would be an example of:

A

Risk analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

True/False: The only real risk mitigation technique is based on effective implementation of technical controls.

A

FALSE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Should a risk assessment consider controls that are planned but not yet implemented?

A

Yes, because it would not be appropriate to recommend implementing controls that are already planned

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the purpose of a control?

A

Controls are used to resolve vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the definition of risk assessment?

A

The evaluation of the level of risk to an information system.

38
Q

What is residual risk?

A

The level of risk that remains after the implementation of controls

39
Q

What is the primary focus of risk assessment?

A

Regulatory requirements

40
Q

What is audit detection risk?

A

The risk that the tests used during an audit did not discover an error

41
Q

What is inherent risk?

A

A risk associated with pre-existing errors in the control environment

42
Q

What is the first phase of the risk analysis process?

A

Critical asset identification

43
Q

What are the components of risk analysis?

A

Threat, vulnerability and impact

44
Q

What is the relationship between risk assessment and audit?

A

Risk assessment is used to identify high-risk areas to be audited

45
Q

The intent of a control is to:

A

Reduce the likelihood or impact of the threat

46
Q

If the materiality is minimal then:

A

It may be ignored

47
Q

The determination of materiality is:

A

Based on the judgment of the auditor

48
Q

An example of a preventative control is:

A

B) A security policy

49
Q

An example of a detective control is:

A

Review of audit logs

50
Q

A corrective control is designed to:

A

Restore systems to normal

51
Q

An example of a corrective control is:

A

A business continuity plan

52
Q

An organization implements a procedure to control changes to the configuration of an information system. This would be an example of a(n):

A

Administrative Control

53
Q

Administrative controls are used to:

A

Monitor compliance with policy

54
Q

Internal controls may be:

A

either manual or automated

55
Q

The development of an IS Audit strategy will include:

A

Identification of controls to be evaluated

56
Q

Once the audit strategy is developed, the auditor will:

A

Communicate the strategy to management.

57
Q

What control classification would an auditor use to monitor an organization’s internal corporate network in order to report any unauthorized access attempts?

A

Detective

58
Q

The audit charter is an important document. What is included in the audit charter?

A

The scope of the audit function

59
Q

Developing an audit plan requires the determination of required personnel resources and?

A

Arranging for access to the audit area

60
Q

The audit plan must be designed to ensure compliance with laws and regulations, this will require the knowledge of the regulations and?

A

A review to ensure management were aware of regulations when developing policies and procedures

61
Q

The audit plan will be based on:

A

The stated objectives of the audit

62
Q

The purpose of audit objectives is to establish whether internal controls are minimizing risk and?

A

functioning properly

63
Q

A operational audit is designed to test?

A

The effectiveness of the organization’s internal control environment

64
Q

What is the purpose of a specialized audit?

A

A specialized audit tests the services provided by an external organization

65
Q

What is a primary consideration when performing a forensic audit?

A

Maintaining proper evidence handling and management techniques

66
Q

What is the purpose of audit planning?

A

Audit planning provides a clear overview of the audit before the audit commences

67
Q

What is the most critical step in audit planning?

A

Focus on high risk areas

68
Q

How do laws and regulations affect an audit plan?

A

The audit plan must be designed to test for compliance with laws and regulations

69
Q

What is the responsibility of the auditor in relation to fraud

A

The auditor must always be watchful for fraud while performing an audit

70
Q

Who should be able to see an audit methodology document?

A

The audit methodology document is used to communicate with all audit team members

71
Q

When an auditor finds a minor violation of policy or procedures, what should their course of action be?

A

Include the violation in the audit report

72
Q

When an auditor finds a problem that is outside the scope of the audit plan, what should be done?

A

Consult with audit management about adjusting the scope of the problem

73
Q

An auditor has found a problem and notified management. The problem was immediately fixed. Should the problem be included in the audit report?

A

Yes, all material findings should be in the report, but noted as fixed.

74
Q

True or False? An audit that finds no serious issues may not require the preparation of an audit report

A

FALSE

75
Q

All data gathered during an audit is considered?

A

audit evidence

76
Q

Common methods of gathering information during an audit include:

A

Interviewing

77
Q

When using observation as an audit data gathering method, what is an important concern?

A

Do not disrupt business operations

78
Q

What is a characteristic of a divisional organization structure?

A

Teams operate as separate units within the parent organization

79
Q

What is the advantage of using CAATS to support an audit

A

CAATS provide an effective way to collect and analyze data from different electronic systems

80
Q

When data is gathered to determine whether users are following policies, this is an example of?

A

Compliance audit

81
Q

An audit that validates individual transactions to test the effectiveness of a procedure is a?

A

Substantive audit

82
Q

What type of audit evidence is considered more reliable?

A

Obtained from independent parties

83
Q

An auditor checks 100 transactions to see if they were handled correctly. What type of audit is this

A

Compliance audit

84
Q

An audit that checks that all transactions over $5000 require approval by a supervisor is what type of audit?

A

Substantive audit

85
Q

An auditor needs to select a certain number of transactions for examination. What method may be used for this?

A

Statistical sampling

86
Q

What is the definition of sampling?

A

Selecting a subset of a larger group of items that will represent the entire group

87
Q

Which type of sampling depends on auditor judgement?

A

Non-statistical sampling

88
Q

When, during the SDLC, is a test plan developed?

A

During the design phase

89
Q

What is the purpose of testing?

A

To uncover any bugs or flaws in the system

90
Q

Change management and problem management are parts of a:

A

Configuration management process

91
Q

What form of systems migration will have the least impact on business operations

A

Parallel

92
Q

What task must be done to enable a data migration from an old system to a new one?

A

Ensure that the data is converted to a format acceptable for the new system

CISA 4.0 - ISACA (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions