Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 1.0 - ISACA > Domain 1: The Process of Auditing Information Systems - PART 1 A > Flashcards

Domain 1: The Process of Auditing Information Systems - PART 1 A Flashcards

1
Q

An appropriate control for ensuring the AUTHENTICITY of orders received in an electronic data interchange system application is to:

A

VERIFY the identity of senders and determine if orders correspond to contract terms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

As part of audit planning, an IS auditor is designing various data validation tests to effectively detect transposition and transcription errors. Which of the following will BEST help in detecting these errors?

A

Check digit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

An AUDIT CHARTER should (3):

A

OUTLINE the overall (1) authority, (2) scope and (3) responsibilities of the audit FUNCTION.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A centralized antivirus system DETERMINES whether each personal computer has the latest signature files and installs the latest signature files before allowing a PC to connect to the network. This is an example of a:

A

CORRECTIVE control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A company has recently upgraded its purchase system to incorporate electronic data interchange (EDI) transmissions. Which of the following CONTROLS should be implemented in the EDI interface to provide for efficient data mapping?

A

Functional ACKNOWLEDGEMENTS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Due to unexpected resource constraints of the IS audit team, the AUDIT PLAN, as originally approved, cannot be completed. Assuming the situation is communicated in the audit report, which course of action is MOST acceptable?

A

FOCUS on auditing high-RISK areas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

During a compliance audit of a small bank, the IS auditor notes that BOTH the IT and accounting FUNCTIONS are being performed by the same user of the financial system. Which of the following reviews conducted by the user’s supervisor would represent the BEST compensating control?

A

Examine computer LOG files that show INDIVIDUAL transactions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

During an exit interview, in cases where there is disagreement regarding the impact of a finding, an IS auditor should:

A

Elaborate on the significance of the finding and the risk of not correcting it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

During a risk analysis, an IS auditor identifies threats and potential impacts. Next, the IS auditor should:

A

Identify and evaluate the existing controls.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

During a security audit of IT processes, an IS auditor FOUND that documented security procedures did NOT EXIST. The IS auditor should:

A

IDENTIFY and EVALUATE existing practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

During the PLANNING stage of an IS audit, the PRIMARY goal of an IS auditor is to:

A

Address audit OBJECTIVES

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The EXTENT to which data will be collected during an IS audit should be determined based on the:

A

PURPOSE and scope of the audit being done.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An external IS auditor discovers that systems in the scope of the audit were implemented by an associate. In such a circumstance, IS audit management should:

A

DISCLOSE the issue to the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

An external IS auditor issues an audit report pointing out the lack of firewall protection features at the perimeter network gateway and RECOMMENDING a SPECIFIC vendor product to address this vulnerability. The IS auditor has failed to exercise:

A

Professional INDEPENDENCE.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

The FINAL decision to include a material finding in an audit REPORT should be made by the:

A

IS auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

A financial institution with multiple branch offices has an AUTOMATED control that requires the branch manager to APROVE transactions more than a certain amount. What type of audit control is this?

A

Preventive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

For a retail business with a large volume of transactions, which of the following audit techniques is the MOST appropriate for addressing EMERGING risk?

A

CONTINUOUS auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

In a small organization, the FUNCTION of release manager and application programmer are performed by the SAME employee. What is the BEST compensating CONTROL in this scenario?

A

VERIFY that only approved program changes are implemented

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

In PLANNING an IS audit, the MOST critical STEP is:

A

The IDENTIFICATION of the areas of SIGNIFICANT risk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The internal audit department has written some scripts that are used for continuous auditing of some information systems. The IT department has asked for copies of the scripts so that they can use them for setting up a continuous monitoring process on key systems. Would sharing these scripts with IT affect the ability of the IS auditors to independently and objectively audit the IT function?

A

Sharing the scripts is permissible as long as IT recognizes that audits may still be conducted in areas not covered in the scripts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

An internal IS audit function is planning a general IS audit. Which of the following activities takes place during the FIRST step of the planning phase?

A

Development of a risk assessment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

An IS auditor discovers that devices connected to the network are not included in a network diagram that had been used to develop the scope of the audit. The chief information officer explains that the diagram is being updated and awaiting final approval. The IS auditor should FIRST:

A

Evaluate the impact of the undocumented devices on the audit scope.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

An IS auditor has identified a business process to be audited. The IS auditor should NEXT identify the:

A

Control objectives and activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An IS auditor is developing an audit plan for an environment that includes new systems. The organization’s management wants the IS auditor to focus on recently implemented systems. How should the IS auditor respond?

A

Determine the highest-risk systems and plan accordingly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

An IS auditor is reviewing a project risk assessment and notices that the overall residual risk level is high due to confidentiality requirements. Which of the following types of risk is normally high due to the number of unauthorized users the project may affect?

A

Inherent risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An IS auditor is reviewing a software application that is built on the principles of service-oriented architecture. What is the INITIAL step?

A

Understanding services and their allocation to business processes by reviewing the service repository documentation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

An IS auditor is reviewing risk and controls of a bank wire transfer system. To ensure that the bank’s financial risk is properly addressed, the IS auditor will most likely review which of the following?

A

Wire transfer procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

An IS auditor notes that failed login attempts to a core financial system are automatically logged and the logs are retained for a year by the organization. This logging is:

A

Not an adequate control.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

An IS auditor performing an audit of the risk assessment process should FIRST confirm that:

A

Assets have been identified and ranked

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

An IS auditor performing a review of application controls would evaluate the:

A

Impact of any exposures discovered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

An IS auditor reviewing the process of log monitoring wants to evaluate the organization’s manual review process. Which of the following audit techniques would the auditor MOST likely employ to fulfill this purpose?

A

Walk-through

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

An IS auditor should ensure that review of online electronic funds transfer reconciliation procedures should include:

A

Tracing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

An IS auditor who has discovered unauthorized transactions during a review of electronic data interchange (EDI) transactions is likely to recommend improving the:

A

Authentication techniques for sending and receiving messages.

34
Q

A long-term IT employee with a strong technical background and broad managerial experience has applied for a vacant position in the IS audit department. Determining whether to hire this individual for this position should be PRIMARILY based on the individual’s experience and:

A

Ability, as an IS auditor, to be independent of existing IT relationships.

35
Q

The MAIN purpose of the annual IS audit plan is to:

A

Allocate resources for audits.

36
Q

The MOST effective audit practice to determine whether the operational effectiveness of controls is properly applied to transaction processing is:

A

Substantive testing.

37
Q

The MOST important reason for an IS auditor to obtain sufficient and appropriate audit evidence is to:

A

Provide a basis for drawing reasonable conclusions.

38
Q

An organization’s IS AUDIT CHARTER should specify the:

A

ROLE of the IS audit FUNCTION

39
Q

An organization uses a bank to process its weekly payroll. Time sheets and payroll adjustment forms (e.g., hourly rate changes, terminations) are completed and delivered to the bank, which prepares checks and reports for distribution. To BEST ensure payroll data accuracy:

A

Payroll reports should be COMPARED to input forms.

40
Q

A PRIMARY benefit derived for an organization employing control self- assessment (CSA) techniques is that it:

A

Can IDENTIFY high-RISK areas that might need a detailed review later.

41
Q

The PRIMARY objective of the audit INITIATION meeting with an IS audit client is to:

A

discuss the SCOPE of the audit.

42
Q

The PRIMARY purpose of an IT FORENSIC audit is:

A

the systematic COLLECTION and analysis of EVIDENCE after a system irregularity.

43
Q

The PRIMARY purpose of the IS audit charter is to:

A

outline the RESPONSIBILITY and AUTHORITY of the IS audit function.

44
Q

The PRIMARY reason an IS auditor performs a functional walk-through during the preliminary phase of an audit assignment is to:

A

UNDERSTAND the business PROCESS.

45
Q

The PURPOSE of a CHECKSUM on an amount field in an electronic data interchange communication of financial transactions is to ensure:

A

INTEGRITY.

46
Q

The success of control self-assessment (CSA) DEPENDS highly on:

A

line managers assuming a portion of the responsibility for control monitoring.

47
Q

A system developer transfers to the audit department to serve as an IT auditor. When production systems are to be reviewed by this employee, which of the following will become the MOST significant concern?

A

The work may be construed as a self-audit.

48
Q

To ensure that audit resources deliver the best value to the organization, the FIRST step in an audit project is to:

A

develop the audit PLAN on the basis of a detailed RISK assessment.

49
Q

What is the MAJOR benefit of conducting a control self-assessment (CSA) over a traditional audit?

A

It detects risk sooner.

50
Q

When developing a risk-based audit strategy, an IS auditor should conduct a risk assessment to ensure that:

A

vulnerabilities and threats are identified.

51
Q

When developing a risk management program, what is the FIRST activity to be performed?

A

Inventory of assets

52
Q

When evaluating the collective effect of preventive, detective and corrective controls within a process, an IS auditor should be aware of which of the following?

A

The point at which controls are exercised as data flow through the system

53
Q

When evaluating the controls of an electronic data interchange (EDI) application, an IS auditor should PRIMARILY be concerned with the risk of:

A

improper transaction authorization.

54
Q

When performing a risk analysis, the IS auditor should FIRST:

A

IDENTIFY the organization’s information ASSETS.

55
Q

Which of the following choices would be the BEST source of information when developing a risk-based audit plan?

A

Senior management identify key business processes.

56
Q

Which of the following controls would an IS auditor look for in an environment where duties cannot be appropriately segregated?

A

Compensating controls

57
Q

Which of the following does a lack of adequate controls represent?

A

A vulnerability

58
Q

Which of the following is an attribute of the control self- assessment approach?

A

Broad stakeholder involvement

59
Q

Which of the following is evaluated as a preventive control by an IS auditor performing an audit?

A

Table lookups

60
Q

Which of the following is in the BEST position to approve changes to the audit charter?

A

Audit committee

61
Q

Which of the following is MOST important for an IS auditor to understand when auditing an e- commerce environment?

A

The nature and criticality of the business process supported by the application

62
Q

Which of the following is MOST important to ensure that effective application controls are maintained?

A

Control self- assessment

63
Q

Which of the following is MOST likely be considered a conflict of interest for an IS auditor who is reviewing a cybersecurity implementation?

A

Designing the cybersecurity controls

64
Q

Which of the following is the FIRST step in an IT risk assessment for a risk-based audit?

A

Understand the business, its operating model and key processes.

65
Q

Which of the following is the FIRST step performed prior to creating a risk ranking for the annual internal IS audit plan?

A

Define the audit universe.

66
Q

Which of the following is the key benefit of a control self- assessment?

A

Management ownership of the internal controls supporting business objectives is reinforced.

67
Q

Which of the following is the MAIN reason to perform a risk assessment in the planning phase of an IS audit?

A

To provide reasonable assurance material items will be addressed

68
Q

Which of the following is the MOST critical step when planning an IS audit?

A

Perform a risk assessment.

69
Q

Which of the following is the PRIMARY purpose of a risk-based audit?

A

Material areas are addressed first.

70
Q

Which of the following is the PRIMARY requirement for reporting IS audit results? The report is:

A

Backed by sufficient and appropriate audit evidence.

71
Q

Which of the following represents an example of a preventive control with respect to IT personnel?

A

Implementation of a badge entry system for the IT facility

72
Q

Which of the following represents the GREATEST potential risk in an electronic data interchange (EDI) environment?

A

Lack of transaction authorizations

73
Q

Which of the following responsibilities would MOST likely compromise the independence of an IS auditor when reviewing the risk management process?

A

Participating in the design of the risk management framework

74
Q

Which of the following situations could impair the independence of an IS auditor? The IS auditor:

A

Implemented specific functionality during the development of an application

75
Q

Which of the following would be expected to approve the audit charter?

A

Audit committee

76
Q

Which of the following would be the GREATEST concern if audit objectives are not established during the initial phase of an audit program?

A

Important business risk may be overlooked

77
Q

While performing an audit of an accounting application’s internal data integrity controls, an IS auditor identifies a major control deficiency in the change management software supporting the accounting application. The MOST appropriate action for the IS auditor to take is to:

A

Continue to test the accounting application controls and include the deficiency in the final report.

78
Q

While planning an IS audit, an assessment of risk should be made to provide:

A

Reasonable assurance that the audit will cover material items.

79
Q

While reviewing sensitive electronic work papers, the IS auditor noticed that they were not encrypted. This could compromise the:

A

Confidentiality of the work papers.

80
Q

Why does an audit manager review the staff’s audit papers, even when the IS auditors have many years of experience?

A

Professional standards

CISA 1.0 - ISACA (51 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions