Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CISA 1.0 - ISACA > Domain 1: The Process of Auditing Information Systems - PART 1 B > Flashcards

Domain 1: The Process of Auditing Information Systems - PART 1 B Flashcards

1
Q

After identifying the findings, the IS auditor should FIRST:

A

gain agreement on the findings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

After initial investigation, an IS auditor has reasons to believe that fraud may be present. The IS auditor should:

A

expand activities to determine whether an investigation is warranted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

After reviewing the disaster recovery planning process of an organization, an IS auditor requests a meeting with organization management to discuss the findings. Which of the following BEST describes the main goal of this meeting?

A

Confirming factual accuracy of the findings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

An auditee disagrees with an audit finding. Which of the following is the BEST course of action for the IT auditor to take?

A

Discuss the finding with the IT auditor’s manager.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The BEST method of confirming the accuracy of a system tax calculation is by:

A

preparing simulated transactions for processing and comparing the results to predetermined results.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Corrective action has been taken by an auditee immediately after the identification of a reportable finding. The auditor should:

A

include the finding in the final report, because the IS auditor is responsible for an accurate report of all findings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The decisions and actions of an IS auditor are MOST likely to affect which of the following types of risk?

A

Detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

During an audit, the IS auditor notes the application developer also performs quality assurance testing on another application. Which of the following is the MOST important course of action for the auditor?

A

Report the identified condition.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

During an IS audit, which is the BEST method for an IS auditor to evaluate the implementation of segregation of duties within an IT department?

A

Discuss it with the IT managers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

During the course of an application software review, an IS auditor identified minor weaknesses in a relevant database environment that is out of scope for the audit. The BEST option is to:

A

report the weaknesses as observed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The effect of which of the following should have priority in planning the scope and objectives of an IS audit?

A

Applicable statutory requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In a risk-based IS audit, where both inherent and control risk have been assessed as high, an IS auditor would MOST likely compensate for this scenario by performing additional:

A

substantive testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The internal IS audit team is auditing controls over sales returns and is concerned about fraud. Which of the following sampling methods would BEST assist the IS auditors?

A

Discovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

In the process of evaluating program change controls, an IS auditor would use source code comparison software to:

A

examine source program changes without information from IS personnel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

An IS audit department is considering implementing continuous auditing techniques for a multinational retail enterprise that processes a large volume of transactions per day. A PRIMARY benefit of continuous auditing is that:

A

fraud can be detected more quickly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

An IS auditor conducting a review of disaster recovery planning (DRP) at a financial processing organization has discovered the following:
> The existing DRP was compiled two years earlier by a systems analyst in the organization’s IT department using transaction flow projections from the operations department.
> The DRP was presented to the deputy chief executive officer (CEO) for approval and formal issue, but it is still awaiting attention.
> The DRP has never been updated, tested or circulated to key management and staff, although interviews show that each would know what action to take for its area if a disruptive incident occurred.. The IS auditor’s report should recommend that:

A

a manager coordinates the creation of a new or revised plan within a defined time limit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

An IS auditor conducting a review of software usage and licensing discovers that numerous PCs contain unauthorized software. Which of the following actions should the IS auditor take?

A

Report the use of the unauthorized software and the need to prevent recurrence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

An IS auditor discovers a potential material finding. The BEST course of action is to:

A

perform additional testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An IS auditor finds a small number of user access requests that were not authorized by managers through the normal predefined workflow steps and escalation rules. The IS auditor should:

A

perform an additional analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An IS auditor finds that a disaster recovery plan for critical business functions does not cover all systems. Which of the following is the MOST appropriate course of action for the IS auditor?

A

Alert management and evaluate the impact of not covering all systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

An IS auditor finds that the answers received during an interview with a payroll clerk do not support job descriptions and documented procedures. Under these circumstances, the IS auditor should:

A

expand the scope to include substantive testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

An IS auditor is carrying out a system configuration review. Which of the following would be the BEST evidence in support of the current system configuration settings?

A

Standard report with configuration values retrieved from the system by the IS auditor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

An IS auditor is comparing equipment in production with inventory records. This type of testing is an example of:

A

substantive testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An IS auditor is conducting a compliance test to determine whether controls support management policies and procedures. The test will assist the IS auditor to determine:

A

that the control is operating as designed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

An IS auditor is determining the appropriate sample size for testing the existence of program change approvals. Previous audits did not indicate any exceptions, and management has confirmed that no exceptions have been reported for the review period. In this context, the IS auditor can adopt a:

A

lower confidence coefficient, resulting in a smaller sample size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An IS auditor is planning to evaluate the control design effectiveness related to an automated billing process. Which of the following is the MOST effective approach for the auditor to adopt?

A

Walk-through

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

An IS auditor is reviewing access to an application to determine whether recently added accounts were appropriately authorized. This is an example of:

A

compliance testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

An IS auditor is reviewing security controls for a critical web-based system prior to implementation. The results of the penetration test are inconclusive, and the results will not be finalized prior to implementation. Which of the following is the BEST option for the IS auditor?

A

Publish a report based on the available information, highlighting the potential security weaknesses and the requirement for follow-up audit testing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

An IS auditor is testing employee access to a large financial system, and the IS auditor selected a sample from the current employee list provided by the auditee. Which of the following evidence is the MOST reliable to support the testing?

A

A list of accounts with access levels generated by the system

30
Q

An IS auditor is validating a control that involves a review of system- generated exception reports. Which of the following is the BEST evidence of the effectiveness of the control?

A

A sample system- generated exception report for the review period, with follow- up action items noted by the reviewer

31
Q

An IS auditor notes daily reconciliation of visitor access card inventory is not aligned with the organization’s procedures. Which of the following is the auditor’s BEST course of action?

A

Report the lack of daily reconciliations.

32
Q

An IS auditor reviews one day of logs for a remotely managed server and finds one case where logging failed, and the backup restarts cannot be confirmed. What should the IS auditor do?

A

Expand the sample of logs reviewed.

33
Q

An IS auditor should use statistical sampling and not judgmental (nonstatistical) sampling, when:

A

the probability of error must be objectively quantified.

34
Q

An IS auditor uses computer- assisted audit techniques (CAATs) to collect and analyze data. Which of the following attributes of evidence is MOST affected by the use of CAATs?

A

Reliability

35
Q

An IS auditor wants to analyze audit trails on critical servers to discover potential anomalies in user or system behavior. Which of the following is the MOST suitable for performing that task?

A

Trend/variance detection tools

36
Q

An IS auditor wants to determine the effectiveness of managing user access to a server room. Which of the following is the BEST evidence of effectiveness?

A

Observation of a logged event

37
Q

An IS auditor wants to determine the number of purchase orders not appropriately approved. Which of the following sampling techniques should an IS auditor use to draw such conclusions?

A

Attribute

38
Q

An IS auditor who was involved in designing an organization’s business continuity plan (BCP) has been assigned to audit the plan. The IS auditor should:

A

communicate the possibility of conflict of interest to audit management prior to starting the assignment.

39
Q

The MAIN advantage of an IS auditor directly extracting data from a general ledger systems is:

A

greater assurance of data validity

40
Q

The MOST appropriate action for an IS auditor to take when shared user accounts are discovered is to:

A

document the finding and explain the risk of using shared IDs.

41
Q

The PRIMARY advantage of a continuous audit approach is that it:

A

allows the IS auditor to review and follow up on audit issues in a timely manner.

42
Q

The PRIMARY purpose for meeting with auditees prior to formally closing a review is to:

A

gain agreement on the findings.

43
Q

A substantive test to verify that tape library inventory records are accurate is:

A

conducting a physical count of the tape inventory.

44
Q

The vice president of human resources has requested an IS audit to identify payroll overpayments for the previous year. Which would be the BEST audit technique to use in this situation?

A

Generalized audit software

45
Q

What is the BEST course of action for an IS auditor to take when an outsourced monitoring process for remote access is inadequate and management disagrees because management stated that intrusion detection system (IDS) and firewall controls are in place?

A

Document the identified finding in the audit report.

46
Q

What is the PRIMARY requirement that a data mining and auditing software tool should meet? The software tool should:

A

accurately capture data from the organization’s systems without causing excessive performance problems.

47
Q

When preparing an audit report the IS auditor should ensure that the results are supported by:

A

sufficient and appropriate audit evidence.

48
Q

When selecting audit procedures, an IS auditor should use professional judgment to ensure that:

A

sufficient evidence will be collected.

49
Q

When testing program change requests for a remote system, an IS auditor finds that the number of changes available for sampling would not provide a reasonable level of assurance. What is the MOST appropriate action for the IS auditor to take?

A

Develop an alternate testing procedure.

50
Q

Which audit technique provides the BEST evidence of the segregation of duties in an IT department?

A

Observation and interviews

51
Q

Which of the following audit techniques would BEST help an IS auditor in determining whether there have been unauthorized program changes since the last authorized program update?

A

Automated code comparison

52
Q

Which of the following BEST describes the objective of an IS auditor discussing the audit findings with the auditee?

A

Confirm the findings and propose a course of corrective action.

53
Q

Which of the following BEST ensures the effectiveness of controls related to interest calculation for an accounting system?

A

Re- performance

54
Q

Which of the following forms of evidence would an IS auditor consider the MOST reliable?

A

The results of a test performed by an external IS auditor

55
Q

Which of the following is a PRIMARY objective of embedding an audit module while developing online application systems?

A

To collect evidence while transactions are processed

56
Q

Which of the following is MOST effective for monitoring transactions exceeding predetermined thresholds?

A

Generalized audit software

57
Q

Which of the following is MOST important to ensure before communicating the audit findings to top management during the closing meeting?

A

Findings are clearly tracked back to evidence.

58
Q

Which of the following is the BEST factor for determining the required extent of data collection during the planning phase of an IS compliance audit?

A

Purpose, objective and scope of the audit

59
Q

Which of the following is the MOST important skill that an IS auditor should develop to understand the constraints of conducting an audit?

A

Project management

60
Q

Which of the following sampling methods is MOST useful when testing for compliance?

A

Attribute sampling

61
Q

Which of the following sampling methods is the MOST appropriate for testing automated invoice authorization controls to ensure that exceptions are not made for specific users?

A

Stratified random sampling

62
Q

Which of the following sampling methods would be the MOST effective to determine whether purchase orders issued to vendors have been authorized as per the authorization matrix?

A

Attribute sampling

63
Q

Which of the following should an IS auditor use to detect duplicate invoice records within an invoice master file?

A

Computer- assisted audit techniques

64
Q

Which of the following should be the FIRST action of an IS auditor during a dispute with a department manager over audit findings?

A

Revalidate the supporting evidence for the finding.

65
Q

Which of the following will MOST successfully identify overlapping key controls in business application systems?

A

Replacing manual monitoring with an automated auditing solution

66
Q

Which of the following would be MOST useful for an IS auditor for accessing and analyzing digital data to collect relevant audit evidence from diverse software environments?

A

Computer- assisted auditing techniques

67
Q

Which of the following would impair the independence of a quality assurance team?

A

Correcting coding errors during the testing process

68
Q

Which of the following would normally be the MOST reliable evidence for an IS
auditor?

A

A confirmation letter received from a third party verifying an account balance

69
Q

Which technique would BEST test for the existence of dual control when auditing the wire transfer systems of a bank?

A

Observation

70
Q

While auditing a third-party IT service provider, an IS auditor discovered that access reviews were not being performed as required by the contract. The IS auditor should:

A

Report the issue to IT management

CISA 1.0 - ISACA (51 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions