Information System Auditing - Planning Flashcards
What would be considered a “MOST” critical step in planning an Information Systems (IS) Audit?
Identification of the areas of significant risk
Note: It is important to identify the areas of highest risk (which will determine the areas to be audited)
What should an IS Auditor do when they find that documented security procedures do NOT exist?
Identify and evaluate existing practices
Note: One main objective of an audit is to identify potential risk - the most proactive approach is to identify and evaluate existing security practices being followed
What would be considered a “PRIMARY” motive in deciding whether or NOT to hire an IT employee for a long-term IS audit position?
An ability as an IS auditor to be independent of existing IT relationships
What is the FIRST activity to be performed when developing a risk management program?
Completing an inventory of assets
i.e. identifying the assets to be protected is the first step in risk management program development
WHAT is the purpose of a “checksum” on an amount field in an electronic data interchange (EDI) communication for a financial transaction?
Integrity
i.e. The “checksum” function can be used to identify unauthorized modifications
What control should be implemented into an electronic data interchange (EDI) interface for efficient data mapping?
Functional Acknowledgement
WHY? - Because this acts as an audit trail for the EDI interface and is used as one of the main controls in data mapping
What is the best way to ensure payroll data accuracy for a company that uses a bank for weekly payroll?
Comparing input forms to payroll reports
i.e. payroll reports should be compared to input forms
WHY? - Because this helps verify the data input (input forms) with the results of the payroll reports
This is the best way to confirm data accuracy when input is provided by the organization and output is generated by the bank
What is a key dependent of control self-assessment (CSA)?
Line managers assuming a portion of the responsibility for control monitoring
WHY? - Because the primary objective of a CSA program is to leverage the internal audit function by shifting some of the control monitoring responsibilities to the functional area line managers
WHO should make the final decision to include a material finding in an audit report?
THE IS Auditor
WHY? - Because the IS Auditor should make all final decisions on what to include (or exclude) from the report
What is the risk if the IS Auditor observes the electronic work papers were not encrypted?
Confidentiality of the work papers
Encryption provides confidentiality for the electronic work papers
WHAT should the IS Auditor confirm “First” when performing an audit of the risk assessment process?
Assets have been identified and ranked.
i.e. Identifying and ranking of information assets (E.g. data criticality, sensitivity, locations of assets) will set the tone or scope of how to assess risk in relation to the organizational value of the asset.
What should be specified in the IS audit charter?
THE role of the IS audit function
WHY? - Because the IS audit charter establishes the role of the information systems audit function - and describe the overall authority, scope and responsibilities of the audit function.
WHAT would be considered a “Key Benefit” of a Control Self-Assessment (CSA)?
That management ownership of the internal controls supporting business objectives is reinforced
WHY? - Because the objective of CSA is to have business management become more aware of the importance of internal control and their responsibility
What is a main concern of an IS auditor when reviewing the quality assurance (QA) function in an organization and who the report to?
The effectiveness of the QA function because it should interact between project and user management
WHY? - Because to be effective, the QA function should be independent of project management. If not, project management may put pressure on the QA function to approve an inadequate product
What is an initial step when an IS auditor is reviewing a software application that has service-oriented architecture?
To gain an understanding of the services and their allocation to business processes - by reviewing the service repository documentation
i.e. it is essential for the IS auditor to comprehend the mapping of business processes to services; before reviewing services in detail
