Domain 1 Flashcards
Risk that an activity would pose if no controls were in place (Risk BEFORE controls)
Inherent Risk
Role of IS Auditor in CSA process
Facilitator
Is hash totals a preventative or detective control
Detective
Role of IS audit function is established by?
audit charter
An audit charter is approved by
senior management
When is it appropriate for an audit charter to change?
only if it can be thoroughly justified; It is not meant to change
What type of testing requires gathering evidence to evaluate the integrity of data, transaction, or other information?
Substantive Testing
Compliance testing sampling method that is more effective (attribute vs variable)
Attribute sampling
most important success factor for CSA
line management involvement
Risk assessment is (subjective or objective)
subjective
Overarching document that covers the entire scope of activities in an entity
audit charter
focused on a particular audit exercise that is sought to be initiated by an organization
engagement letter
backup procedures are which type of control (preventative or corrective)
corrective
Probability of an event occurring
and
its consequences
Risk
describe the authority and responsibilities of the audit department
audit charter
Testing that checks for the presence of controls
Compliance Testing
Testing that checks for the integrity of control contents
Substantive Testing
first step of risk assessment
identify assets
online audit technique that is most effective for the early detection of errors or irregularities
audit hook
primary objective of IS Audit function
determine whether information systems safeguard assets and maintain data integrity
- Identify Assets
- Identify Risk (Threat or Vulnerability)
- Impact Analysis (Qualitative or Quantitative)
- Prioritize risk (based on Impact)
- Evaluate/ choose the best controls
- Apply controls
6 Steps of Risk Assessment
Risks that are not in our control.
i.e. Earthquake, Fire, Hackers, Malware, System Failure, Criminals
Threat
Weakness that is in our control.
i.e. weak coding, missing anti-virus, weak access controls
Vulnerability
Risk that remains after controls are implemented (Risk AFTER Controls) “Residue”
Residual Risk
Risk that auditors will not detect material misstatement in financial statements
Detection Risk
Risk that a material misstatement occurs but is not detected, corrected, or prevented by internal controls
Control Risk
inherent risk * control risk * detection risk
Audit Risk
What establishes the IS Audit function?
Audit Charter
Who approves the Audit Charter?
Top Management/ Highest level of management
What is included in the audit charter?
Authority, Scope, and Responsibilities of the Audit Function
What influences the auditors decisions/responsibilities/ roles within the audit?
Audit Charter
How often should the audit charter change?
It should NOT change. If it does, it has to be thoroughly justified.
Are these included in the audit charter?
-audit calendar, audit planning, yearly resource allocation, routine audit activities (professional fees and travel expenses/ budgets
NO, they change too often and are not aligned with the “authority, scope, or responsibilities of the audit function”
