Performing an Audit

Question 1

What is an IS audit

Answer 1

An audit of information systems and the process that support them.

Question 2

Audit formal planning

Answer 2

1-Purpose - Auditor and auditee establish reason of why the audit

2-Scope - Auditor and Auditee establish scope

3-Risk Analysis - Auditor needs to know which area require the greatest amount of attention

4-Audit procedures
5-Resources
Schedules

Question 3

Audit Objective

Answer 3

To determine if controls exist and are effective in some specific aspect of business operation in an organization.

Question 4

Types of Audit

Answer 4

Operational Audit, financial audit, integrated audit (Financial +operational) , IS audit, Administrative Audit, compliance audit, forensic audit, service provider audit.

Question 5

Statement of Attestation Engagement 16 (SSAE 16)

Answer 5

Standard developed by AICPA for the purpose of auditing third party service organization that perform financial services on behalf of their customers.

Question 6

Pre-audit

Answer 6

Not technically an audit, but a examination of business process, IS systems, ..in anticipation of an upcoming external audit.

Question 7

Difference between compliance testing and substantive testing

Answer 7

Compliance testing : used to determine if control procedures have been properly designed and implemented, and are operating properly.

Substantive testing : used to determine the accuracy and integrity of transactions that flow through processes and information systems.

Question 8

Audit methodology

Answer 8

• Audit subject : determine the business process, information system, or other domain to be audited
• Audit Objective : Identify the purpose of the audit.
• Type of Audit : identify the type of audit to be performed.
• Audit scope : The business process, department, or application that is the subject of the audit needs to be identified.

Question 9

Audit Statement of Work

Answer 9

For an external audit, the IS auditor may need to develop a statement of work or engagement letter that describes the audit purpose, scope, duration, and costs. The auditor may require a written approval from the client before audit work can officially begin.

Question 10

Audit evidence

Answer 10

Evidence is the information collected by the auditor during the course of the audit project. The contents and reliability of the evidence obtained are used by the IS auditor to reach conclusions on the effectiveness of controls and control objectives.

Question 11

Kinds of audit evidence

Answer 11

observations, written notes, correspondence, independent confirmations from other auditors, internal process and procedure documentation, business control

Question 12

Characteristics to consider for reliability of evidence

Answer 12

• Independence of the evidence provider
• Qualifications of the evidence provider
• Objectivity
• Timing