Other Areas (other 25%) Flashcards
Users delegated to run the internal audit department to make decisions regarding the audit process
Audit Administrators
Users with the responsibility to plan, conduct, and manage audit engagements
Audit Managers
Those users that conduct Control Tests and other tasks on behalf of an audit engagement
Internal Auditors
Four types of child tasks of an Engagement
Walkthrough
Control Test
Interview
Activity
Can an Audit activity generate tasks?
Yes
Performs a Design and/or operation test to determine overall effectiveness of a control
Control Test
Data gathering task often used by auditors to learn a process or find and corroborate audit evidence
Interview
Establishes the reliability of an organization’s internal control over a procedure or process.
Walkthrough
A generic task to track other activities that occur during Engagements
Activity
Subtask of an audit task
Activity
Three interview types
Structured
Unstructured
Mixed
Application used to track audit
Audit Engagement Workbench
Generic audit test that applies to Control Objectives
Test Template
Specific audit test that applies to a control
Test Plan
Engagement Lifecycle
Scope Validate Fieldwork Awaiting Approval Follow-up Closed
A __________ is a specific audit test of the design and operating effectiveness of a single control
Test Plan
Test plans are used to generate Control Tests during engagements
Control test lifecycle
Open
Work in Progress
Review
Close
What is true about Control Effectiveness
Both Design Effectiveness and Operation Effectiveness must be effective for Control Effectiveness to be marked Effective
Map authoritative sources to policies, controls, and risks
P&C
Automate and manage policy lifecycles
P&C
Continuously monitor for compliance
P&C
Internal goals and objectives
P&C
external legislation and regulations
P&C
establish controls and control owners
P&C
Prepare attestations and indicators
P&C
Continuously monitor risk exposure
Risk Management & Advanced Risk
prioritize critical risks
Risk Management & Advanced Risk
reduce mediation time
Risk Management & Advanced Risk
develop risk assessments and response procedures
Risk Management & Advanced Risk
measure risk exposure and improvements
Risk Management & Advanced Risk
Page 16 for frameworks
Page 16 for frameworks
GRC: Profiles (Terms)
Entity
Indicator
Issue
Alternative Names: Control Objective
Control
Control Template
Alternative Names: Entity
Scope Definition
Scope Object
Target
Profile
Alternative Names: Entity Type
Entity Group
Alternative Names: Control
Control Instance
Alternative Names: Risk Statement
Risk Template
Alternative Names: Issue
Finding
Page 23 - Application Menus and Modules
Application Menus and Modules
Page 24 - Store Apps and Plugins
Store Apps and Plugins
What’s included with SOX content pack
SOX Policies Pre-defined entities and entity types COs and Risk Statements Controls & Risks Test Templates and Test Plans SOX Audit and Audit Tasks Indicators SOX Control Attestation Templates Reports & dashboards
