IS AUDIT Flashcards
Enumerate the four Audit Process
PLANNING
COMPLIANCE TESTING
SUBSTANTIVE TESTING
REPORTING
The IS auditor and the auditee must establish a reason why an audit is to be performed.
Purpose
To know which areas require the greatest amount of attention,
the IS auditor needs to be familiar with the levels of risk associated with the domain being audited.
Risk Analysis
It could be a given period, meaning records spanning a start date and end date may comprise the body of evidence, geography (systems in a particular region or locale), technology (systems using a specific operating system, database, application, or other aspect), business process (systems that support specific processes such as accounting, order entry, or customer support), or segment of the organization.
scope
There may be specific rules on sample sizes and sampling techniques, or it may require the auditors with specific qualifications to perform the audit. A
Audit procedures
The IS auditor needs to develop an audit schedule that will
give enough time for interviews, data collection and analysis, and report generation.
Schedule
The IS auditor must determine what resources are needed and available for the audit.
Resources
Refers to the specific goals for an audit
Audit objectives
This type of audit is an examination of IS controls, security controls, or business controls to determine control existence and
effectiveness.
Operational Audit
This type of audit is an examination of the organization’s accounting system, including accounting department processes and procedures.
Financial Audit
This type of audit combines an operational audit and a
financial audit in order for the auditor to gain a complete understanding
of the entire environment’s integrity
Integrated Audit
This type of audit is a detailed examination of most or all of an IS
department’s operations.
IS Audit
This type of audit is an examination of operational efficiency within some segment of the organization
Administrative Audit
This type of audit is performed to determine the level
and degree of compliance to a law, regulation, standard, or internal control.
Compliance Audit
This type of audit is usually performed by an IS auditor or a forensic specialist in support of an anticipated or active legal proceeding.
Forensic audit
An examination of
business processes, IS systems, and business records in anticipation of an upcoming external audit.
Pre-audit
This type of testing is used to determine if control procedures have been properly designed and implemented, and that they are operating properly
Compliance testing
This type of testing is used to determine the accuracy and integrity of transactions that flow through processes and information systems
Substantive testing
The information collected by the auditor during the course of the audit project.
Evidence
Enumerate Characteristics of an IS Auditor
Independence
Qualifications
Objectivity
Timing
Refers to the technique that is used when it is not feasible to test an entire population of transactions.
Sampling
A technique of random selection is used that
will statistically reflect the entire population
Statistical Sampling
In this type of sampling the IS auditor judgmentally and subjectively selects samples based on established criteria such as risk or materiality.
Judgmental Sampling
Used to calculate an average by group, similar to demographics, whereby the entire population is divided into smaller groups based on similar characteristics
Stratified Sampling
The precision rate indicates the acceptable margin of error between audit samples and the total quantity of the subject population.
Precision or Expected Error Rate
Used to determine the difference between audited and unaudited
claims of value.
Difference Estimation
Used to indicate the maximum number of errors that can exist
without declaring a material misstatement.
Tolerable error rate
Any act of deception used to gain an advantage. the intentional deception made for personal gain or damage to another party.
Fraud
Established as a dollar amount threshold that is calculated in one of several possible ways
Materiality
The term that
describes the action taken to address a risk.
Risk Treatment
This involves making changes to processes, procedures, systems, or controls that will reduce either the probability of a threat or its impact.
Risk reduction
This typically involves the use of insurance, which is used to
compensate the organization for the financial losses or damages that will
occur if the threat were realized
Risk Transfer
The organization will cease the activity associated with
the risk.
Risk Avoidance
In this case, the organization feels that the risk is acceptable
and that no measures need to be taken to reduce the risk further.
Risk Acceptance
TRUE OR FALSE:
The audit must be based on meaningful evidence that is materially relevant.
True
TRUE OR FALSE: The auditor should design every audit to adhere to standards.
True
TRUE OR FALSE:
The interview process must be scheduled
and must implement predefined questions for the purpose of gathering data.
True
TRUE OR FALSE:
Test results are usually reported as noteworthy for special achievement, conforming to
minimum requirements, opportunity for improvement, a concern that’s not a violation yet,
and nonconformity.
True
TRUE OR FALSE:
Continuous audit methods such as audit hooks or SCARF with embedded audit modules (SCARF/EAM) are used in environments where it
is possible to interrupt production.
False
TRUE OR FALSE:
The best evidence will tell its own story.
True
TRUE OR FALSE:
Irrelevant evidence will not affect the final decision
True
TRUE OR FALSE:
Test results are usually reported as noteworthy for special achievement, conforming to minimum requirements, opportunity for improvement, a concern that’s not a violation yet,
and nonconformity.
True
TRUE OR FALSE:
An independent auditor can work on fixing problems.
False
TRUE OR FALSE:
Issues of high significance should be communicated directly to the audit committee.
True
TRUE OR FALSE:
Control self‐assessments are designed to empower the customer’s staff.
True
TRUE OR FALSE:
The purpose of the controls is to prevent harm and
protect an asset.
True
