Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA > Domain 1 LearnZapp > Flashcards

Domain 1 LearnZapp Flashcards

1
Q

Which are more formal - audits or assessments?

A

Audits

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

<blank> is the person setting the scope for the audit, and the <blank> performs the work.
</blank></blank>

A

Client, auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Who signs and enforces the policy?

A

highest level of management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

<blank> is required for an external audit
</blank>

A

Auditor independence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

<blank> are mandatory controls designed to support a policy. <blank> is discretionary.
</blank></blank>

A

Standards, guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Best description of an ongoing audit program for regulatory compliance

A

An audit is a series of unique projects of short duration that add up to cover all the steps necessary for annual compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Purpose of ISACA’s professional ethics statement

A

to clearly specify acceptable and unacceptable behavior

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Auditor’s final opinion to be based on…

A

results of evidence and testing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Common types of audits

A

integrated, operational, compliance, administrative

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Difference between policy and procedure

A

Policy is a high-level document signed by a person of authority, and compliance is mandatory. A procedure defines the mandatory steps to attain compliance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Purpose of standard terms or regulation

A

to ensure honest and unbiased communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In business organization, who will be held by the governance for failures of internal controls?

A

president, vp and other corporate officers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Who specifies controls?

A

Data owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is fiduciary responsibility?

A

Act for the benefit of another person and place the responsibilities to be fair and honest ahead of your own interest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does an auditor derive a final opinion?

A

evidence gathered and auditor’s observations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How should an auditor assist in the remediation of problems found during the audit?

A

Auditor should never take ownership of problems found. Auditors are encouraged to provide general advice to the auditee, including an explanation of what to look for during the audit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The <blank> type of audit checks attributes against the design specifications</blank>

A

product

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Why is it necessary to protect audit documentation and work papers?

A

Audit documentation and work papers may reveal confidential information that should not be lost or disclosed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Difference between ‘should’ and ‘shall.’

A

Should indicates actions that are discretionary according to need, whereas shall means the action is mandatory regardless of financial impact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Audit may uncover irregularities and illegal acts that require disclosure.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is not true regarding audit committee?

A

Executives inside the organization oversee the audit committee and are responsible for keeping the committee busy working on compliance programs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is called having the right people look at the issue, make an intelligent decision and take appropriate action?

A

Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the difference between threat and vulnerability?

A

Vulnerabilities are a path that can be taken by a threat, resulting in a loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is false concerning a control self-assessment?

A

Eliminates the need for a traditional audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Who has the responsibility for setting scope of the audit?

A

client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Documentation used to identify the person responsible for specific tasks

A

skills matrix

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a concern of the auditor that should be explained in the audit report along with the findings?

A

undue restrictions placed by management on evidence use or audit procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Auditor permitted to deviate from professional audit standards when they feel it necessary…

A

Deviation is almost unheard of and would require significant justification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which type of evidence sampling refer to a 100% sample?

A

discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Types of risk are of most interest to IS auditor…

A

sampling, control, detection, inherent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What type of CAAT is designed to process dummy transactions during the process of genuine transactions?

A

embedded audit module

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are two types of tests?

A

substantive and compliance using variable and attribute sampling methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is false in regard to using the work of other people during your audit?

A

Accept the work based on job position

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is another name for an audit used for regulatory licensing or external report?

A

traditional audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Audits are intended to be conducted in accordance with?

A

Adherence to standards, guidelines and best practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is not a quantitative sampling method?

A

Qualitative estimation per unit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is the principle issue concerning use of CAAT?

A

possible cost, complexity and security of output

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is the purpose of an audit charter?

A

grant responsibility, authority and accountability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the difference between compliance and substantive testing?

A

Compliance testing covers checks for the presence of controls; substantive tests check the integrity of internal controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is the purpose of continuous auditing?

A

Assist managers with automated tests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the difference between audit sample and total population?

A

precision

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the biggest issue with the decision to transfer risk to an outsourced contractor?

A

Company still retains liability for whatever happens

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is NOT a purpose of risk analysis?

A

ensure absolute safety during the audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the best document to help define the relationship of the independent auditor and provide evidence of the agreed-upon terms and conditions?

A

engagement letter

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

ISACA refers to testing strong control. What is the best description of a strong control?

A

effective implementation of multiple controls targeting the same objective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What type of risk fails to prevent or detect a material error?

A

detection risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What is the best data collection technique the auditor can use if the resources are available?

A

interviews

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

An IS auditor is performing a review of an application and finds something that might be illegal. What should the IS auditor do?

A

seek legal advice before finishing the audit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Who is responsible for providing internal controls to detect, correct, and prevent irregularities and illegal acts?

A

Board of Directors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is the purpose of an audit committee?

A

to challenge and review assurances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is a concern that the auditor should explain in the audit report along with their findings?

A

undue restrictions placed by management on evidence use or audit procedure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

During performance of an audit, a reportable finding is identified with auditee. The auditee immediately fixed the problem upon identification. What is true as a result of interaction?

A

Auditor lists the finding as it existed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is the primary benefit of using risk-based approach to audit planning?

A

allocates resources to the areas of highest concern

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is the best choice to ensure that internal control objectives are met?

A

suitable systems for tracking and reporting incidents are used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is true concern reporting by internal auditors?

A

The corresponding value of the audit report is low

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Auditor is permitted to deviate from professional audit standards when they feel it is necessary because…

A

deviating from standards is almost unheard of and would require significant justification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is the best definition of auditing?

A

Review of past history using evidence to tell the story

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is a sampling method is used when likelihood of finding evidence is low

A

discovery - known as 100% sample

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is the hierarchy of controls from highest to lowest?

A

general, pervasive, detailed, application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is not one of the 3 major control types?

A

deterrent (major: detective, preventive, corrective)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

After presenting the report at the conclusion of an audit, the lead auditor discovers the omission of a procedure. What should the auditor do next?

A

cancel the report if audit alternates cannot compensate for the deficiency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What does the function of the auditor provide?

A

second set of eyes, which are external to the subject under review

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is the best way for an auditor to prove their competence to perform an audit?

A

citing each point in a regulation with an audit objective and specific test

64
Q

What is true concerning the auditor’s qualified opinion?

A

auditor has reservations about the findings

65
Q

What is the best example of implementing a detective control via administrative methods?

A

auditing of system configuration and log files

66
Q

A nonstatistical audit sample, known as judgmental sample, is defined as?

A

haphazard

67
Q

What is the primary purpose of an audit charter?

A

Assign the auditor responsibility, authority and accountability

68
Q

What audit tool incorporates dummy transactions into the normal processing on a system?

A

integrated test facility - aka embedded audit module

69
Q

Internal controls are developed to provide <blank> assurance that a company's business objectives will be achieved and undesired risk events will be <blank></blank></blank>

A

reasonable; prevented, detected and corrected

70
Q

What is a fundamental limitation of internal controls?

A

Management may exempt themselves from controls

71
Q

A systems audit is responsible for performing tests that <blank> material weaknesses of internal controls.</blank>

A

detect

72
Q

Reliability of an application’s audit trail may be questionable if ….

A

users can amend audit trail records when correcting system errors

73
Q

An IS auditor would perform a <blank> test of program library controls to determine if the source and object versions are the same.</blank>

A

compliance

74
Q

Risk of an IS auditor using an inadequate test procedure and concluding that material errors do not exist when in fact they do is an example of <blank> risk.</blank>

A

detection

75
Q

If an IS auditor discovers a Trojan horse that was produced by a known virus and exploits a vulnerability of an OS, the auditor should ….

A

ensure that the malicious code is remove before doing anything else

76
Q

Prior audit results lack supporting work papers and proper documentation; what should the IS auditor do?

A

Inform audit management and propose retesting the controls

77
Q

What is the primary objective of a logical access control review?

A

ensure that access is granted per organization’s authorities

78
Q

Risk of shared user accounts is that user responsibility ….

A

cannot be established

79
Q

IS auditor observes some data entry operators leave their computers in the midst of data entry without logging off, the auditor should ….

A

recommend implementing a screensaver password to prevent unauthorized access

80
Q

If an IS auditor discovers evidence of fraud perpetrated with a user’s user id that has been shared, then the auditor knows ….

A

the perpetrator cannot be established beyond doubt

81
Q

IS auditor discovers a design weakness in an application’s access controls, what should they do?

A

further investigate the impact of the vulnerability prior to recommending compensating actions to management

82
Q

Most effective control for reducing the exposure to the risk of unauthorized access of data transmitted to and from remote sites?

A

encryption

83
Q

When developing a risk-based audit strategy, an IS auditor should conduct a risk assessment to ensure….

A

vulnerabilities and threats are identified

84
Q

To ensure audit resources deliver the best value to the organization, the first step would be to ….

A

develop the audit plan on the basis of a detailed risk assessment

85
Q

Best factor for determining the extent of data collection during the planning phase of an IS compliance audit?

A

purpose, objective and scope of an audit

86
Q

Decisions and actions of an IS auditor are most like to affect <blank> risk.</blank>

A

detection

87
Q

Initial step in auditing access controls in a client/server environment…

A

Identify network access points

88
Q

<blank> most directly addresses the issue of security policy awareness.
</blank>

A

employee training

89
Q

IS auditor performing telecom access control review should be concerned primarily with ….

A

authentication and authorization of the user prior to granting access to system resources

90
Q

The <blank> auditing method features a <blank> level of complexity. This can be used by the auditor to effectively audit a system running in production.</blank></blank>

A

snapshot, low

91
Q

<blank> provides the basis for security policy decisions.
</blank>

A

Risk management

92
Q

Once a security policy has been designed and approved, what is the most important step?

A

distribute the policy to users

93
Q

IT control objectives are useful to IS auditors because they provide the bases for understanding ….

A

the desired result or purpose of implementing specific control procedures

94
Q

During a controls audit, what would be the most important document to the auditor?

A

Facility blueprint showing access paths

95
Q

Risk related to the ability to perform an audit and gather meaningful evidence…

A

detection risk

96
Q

Sampling method most useful in compliance audit…

A

attribute

97
Q

Which stage are interviewees identified?

A

pre-audit planning

98
Q

Condition is likely to represent a control failure and therefore be a concern to the auditor.

A

Policy without an underlying standard of monitoring and enforcement

99
Q

IS control objectives (protect a system from a loss) include all of the following except…

A

identifying individual threats to a system

100
Q

When could the auditor safely agree to deviate from the published audit standards?

A

never

101
Q

A <blank> is used to ensure that batch data is completely and accurately transferred between 2 systems.</blank>

A

control total

102
Q

When auditing the conversion of an accounting system, an IS auditor should verify the existence of …..

A

control total bit

103
Q

What is the primary issue regarding auditor independence?

A

Independent auditors must not work on the target of the audit

104
Q

An IS auditor’s primary concern when application developers wish to use a copy of yesterday’s production transaction file for volume tests is that ….

A

unauthorized access to sensitive data may result

105
Q

Key steps in selection of a sample of an audit test include all of the following except….

A

substantive testing

106
Q

What is true concerning discovery of potentially illegal activity?

A

Evidence surrounding discovery should be disclosed to the next-higher level of management

107
Q

What is a sample method used in compliance testing?

A

attribute sampling

108
Q

<blank> should be the IS auditor's primary concern when they are conducting a review of an application system after users have completed acceptance testing
</blank>

A

determining if there are unresolved issues

109
Q

What is NOT an acceptable method of risk management?

A

intentionally skipping the disclosure of a threat

110
Q

How does an auditor develop a professional opinion?

A

gathering of evidence and corresponding test results

111
Q

disabling normalization controls in the DB management system can result in <blank> redundancy of data</blank>

A

an unnecessary increase in

112
Q

Reverse engineering will likely involve …..

A

violation of license agreements

113
Q

What is the primary purpose of SLA?

A

define, agreed on, record, and manage the required levels of service

114
Q

During a systems audit, the configuration parameters are reviewed by the auditor. What is the auditor’s primary concern?

A

Settings meet the minimum requirements for proper security

115
Q

What is designed primarily to minimize the impact after an event occurs?

A

corrective

116
Q

What can help an IS auditor determine compliance with an organization’s change control procedures?

A

Identifying changes that have occurred and verifying approvals

117
Q

If an IS auditor reviewing a DB application discovers that the current configuration does not match the originally designed structure, the auditor should then….

A

determine if the modifications were properly approved

118
Q

What is the primary objective of a control self-assessment?

A

To empower worker to assess the active controls

119
Q

Utilizing audit software to compare the object code of two programs is an audit technique used to test program <blank>.</blank>

A

changes

120
Q

Quality is defined as <blank>. With good <blank>, you can expect quality to be present. With poor or missing <blank> it is unlikely that quality could occur.</blank></blank></blank>

A

adherence to specifications, specifications, specifications

121
Q

An auditor can best evaluate program change controls by using <blank> to independently examine source program changes.</blank>

A

source code comparison software

122
Q

What is the biggest concern withe regards to controls?

A

authorization

123
Q

During the review of a biometrics system operation, the IS auditor should first review the stage of <blank>.</blank>

A

enrollment

124
Q

What is the quantifiable method similar to demographics and used to separate the total population into unique groups into unique groups of similar attributes?

A

stratified mean per unit

125
Q

specifying a minimum password length and complexity are control <blank> that help accomplish a control <blank>.</blank></blank>

A

procedures, objective

126
Q

approach not acceptable for gathering information for a risk analysis…

A

sending an email explaining the basics of risk analysis and asking for their cooperation and suggestions

127
Q

True statement concerning materiality

A

Information that would change the outcome of the audit is material

128
Q

what is the best demonstration of the auditor independence requirement?

A

audit and advise without fixing or designing the solution

129
Q

what is the most common issue with audit logs?

A

Logs are not sufficiently reviewed and analyzed

130
Q

What is the type of audit that evaluates both financial records and the internal control structure in a given process or area?

A

integrated audit

131
Q

What is the primary advantage of a continuous audit approach?

A

can improve system security when used in time-sharing environments that process a large number of transactions

132
Q

What is the most appropriate audit technique for a retail business with a large volume of transactions to address emerging risk?

A

continuous auditing

133
Q

What is the first step performed prior to creating a risk ranking for the annual internal IS audit plan?

A

define the audit universe

134
Q

What is the best reason to meet with an auditee prior to closing an audit or review is …..

A

to confirm agreement on the findings

135
Q

What is the primary response to resolving suspicions of unlicensed software usage?

A

determine if the software is actually being used by the organization

136
Q

<blank> makes the final decision to include a material finding in an audit report.
</blank>

A

information systems auditor

137
Q

Failure to protect sensitive electronic work papers represents a risk of a breach of <blank></blank>

A

confidentiality

138
Q

<blank> should specify the role of the audit function
</blank>

A

audit charter

139
Q

<blank> is used to determine if unauthorized changes were made to production programs
</blank>

A

compliance testing

140
Q

What risk is defined as the possibility of the existence of a material error that could not be prevented or detected?

A

control

141
Q

If negative audit findings are not remediated by the target date specified in response to an audit report, an auditor would then ….

A

evaluate the residual risk from unresolved issues

142
Q

What should an auditor do if systems tests do not provide conclusive results?

A

complete the report and provide testing results achieved, but emphasize the need to perform further testing to ensure accuracy of the findings

143
Q

What is a natural risk that always exist?

A

inherent

144
Q

Auditing IT operational capability, what provides the best evidence of whether adequate recovery and restart procedures exist?

A

review operations documentation

145
Q

What is most important when protecting digital evidence?

A

transportation of evidence is carefully documented and logged

146
Q

Without adequate planning and preparation, what is the MOST critical risk in changing from a traditional audit approach to a facilitated control self-assessment?

A

Failure to identify critical risk issues

147
Q

A systems auditor should review <blank> to evaluate planning and investment in IT assets.</blank>

A

IT balanced scorecard

148
Q

An auditor should place more emphasis on an organization’s <blank> when reviewing its IT project portfolio.</blank>

A

business plan

149
Q

A formal IT risk management methodology should consider <blank> within its scope</blank>

A

entire IT environment

150
Q

Following the evidence rule, what could the auditor use to best determine that a given policy is actually being used?

A

enforcement emails

151
Q

An SLA between an organization and a vendor should always include <blank></blank>

A

provisions for independent audit reports or the right to full audit access

152
Q

Which control classification attempts to minimize the impact of a threat?

A

corrective

153
Q

Which sampling method should be used when there is almost no margin of error or the risk of failure is very high?

A

discovery

154
Q

What is most likely encountered in a SaaS environment?

A

performance issues due to the internet delivery method

155
Q

Compensating controls are primarily intended to compensate for what issue?

A

separation

156
Q

<blank> provides the greatest redundancy and least risk of business interruption when a new system is deployed
</blank>

A

running a new system in parallel with the old system

157
Q

When reviewing any newly implemented business process, an IS auditor is most concerned with determining ….

A

if controls are in place to protect assets and informational resources

CISA (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions