Secrets of a Successful Auditor Flashcards
Assessments and audits have several points in common. Which of the following statements provides the best description of an assessment compared to an audit?
A. Audits are more formal than assessments.
B. They are similar in nature; the difference is in wording.
C. Both provide reports that can be used for licensing purposes.
D. Assessment reports provide a high assurance of the situation.
A.
An assessment is less formal than an audit. The purpose of an assessment is to determine value based on relevance. Assessments have a lower value because they are not a regimented independent audit.
- Which of the following statements is true?
A. The auditee is the person running the audit, and the client is the subject of the audit.
B. The auditor is the person running the audit, and the client is the subject of the audit.
C. The client is the person setting the scope for the audit, and the auditor performs the work.
D. The client pays for the audit, and the auditor sets the scope of the audit that will follow.
C.
The client sets the scope of the audit. The auditee is the target (subject) of the audit. The auditor designs the audit plan according to the client’s scope and then performs the audit in accordance with published audit standards and procedures.
Who should issue the organizational policies?
A. Policies should originate from the bottom and move up to the department manager for approval.
B. The auditor should issue the policies in accordance with standards, and they should be authorized by the highest level of management to ensure compliance.
C. The policy should be signed and enforced by any level of management.
D. The policy should be signed and enforced by the highest level of management.
D.
Policies should be signed, issued, and enforced by the highest level of management to ensure compliance by the organization. It is the responsibility of management (not the auditor) to implement internal controls.
- Which of the following options is true about the term auditor independence?
A. It is not an issue for auditors working for a consulting company.
B. It is required for an external audit.
C. An internal auditor must undergo certification training to be independent.
D. The audit committee bestows independence upon the auditor.
B.
The auditor must be independent. Having a personal relationship with the organization being audited could result in a biased opinion. The business relationship is also an issue if the organization has influence over the auditor. The goal is to be fair, objective, and unrelated to the subject of the audit.
- Which of the following assurance methods is acceptable for external use, including licensing?
A. Independent audit
B. Assessment
C. External audit
D. Internal audit
A.
An independent audit is the only one acceptable for external use, including licensing. Internal audits usually lack the independence required because the internal auditor may be overly concerned about their job. Assessments are less formal than an actual audit. External audits could be limited in scope to only what the customer or vendor wants to see.
What is the definition of a standard as compared to a guideline?
A. Standards are discretionary controls used with guidelines to aid the reader’s decision process.
B. Standards are mandatory controls designed to support a policy. Following guidelines is discretionary.
C. Guidelines are recommended controls necessary to support standards, which are discretionary.
D. Guidelines are intended to designate a policy, whereas standards are used in the absence of a policy.
B.
A standard is implemented to ensure a minimum level of uniform compliance. Guidelines are advisory information used in the absence of a standard. Compliance to standards is mandatory; compliance to guidelines is discretionary.
Which of the following is not defined as a non-audit role?
A. System designer
B. Operational staff member
C. Auditor
D. Organizational manager
C.
Every role except an auditor is a nonaudit role. Anyone in a nonaudit role is disqualified from being an independent auditor.
Which of the following is the best description of an ongoing audit program for regulatory compliance?
A. An audit is performed once for the entire year and then repeated by using the same information for each successive year.
B. An audit may be automated by using audit program software.
C An audit is a series of unique projects of short duration that add up to cover all the steps necessary for annual compliance.
D. An audit is a series of assessments performed by the auditee for the purpose of licensing and regulatory compliance.
C.
Projects are unique and usually of limited duration, for a fixed period of time with a definite start and stop date. The projects may be coupled into a series of projects
to fulfill an ongoing operational need, such as an annual audit program or perpetual quality program.
What is the purpose of ISACA’s professional ethics statement?
A. To clearly specify acceptable and unacceptable behavior
B. To provide procedural advisement to the new IS auditor
C. To provide instructions on how to deal with irregularities and illegal acts by the client
D. To provide advice on when it is acceptable for the auditor to deviate from audit standards
A.
This statement specifies that IS auditors are expected to fulfill their duties with the highest standards of honest and truthful representation. It is unacceptable to violate the fiduciary relationship with your client.
10 The auditor’s final opinion is to be based on which of the following?
A. The objectives and verbal statements made by management
B. An understanding of management’s desired audit results
C. The audit committee’s specifications
D. The results of evidence and testing
D.
The auditor is to be a professional skeptic who tests assertions of management and renders an opinion based on the evidence discovered during the audit.
What are common types of audits?
A. Forensic, accounting, verification, regulatory
B. Integrated, operational, compliance, administrative
C. Financial, SAS‐74, compliance, administrative
D. Information systems, SAS‐70, regulatory, procedural
B.
All of the audit types listed are valid except procedural, SAS‐74, verification, and regulatory. The valid audit types are financial, operational (SAS‐70), integrated (SAS‐94), compliance, administrative, forensic, and information systems. A forensic audit is used to discover information about a possible crime.
12 What is the difference between a policy and a procedure?
A. Compliance to a policy is discretionary, and compliance to a procedure is mandatory.
B. A procedure provides discretionary advice to aid in decision-making. The policy defines specific requirements to ensure compliance.
C. A policy is a high‐level document signed by a person of authority, and compliance is mandatory. A procedure defines the mandatory steps to attain compliance.
D. A policy is a mid‐level document issued to advise the reader of desired actions in the absence of a standard. The procedure describes suggested steps to use.
C.
A policy is signed by the person of highest authority to ensure compliance by the members of the organization. Compliance to policies, standards, and procedures is mandatory.
What is the purpose of standard terms of reference?
A. To meet the legal requirement of regulatory compliance
B. To prove who is responsible
C. To ensure honest and unbiased communication
D. To ensure that requirements are clearly identified in a regulation
C.
Standard terms of reference are used between the auditor and everyone else to ensure honest and unbiased communication. Without standard terminology, it would be difficult to know whether we were discussing the same issue or agreed on the same outcome.
Which of the following in a business organization will be held liable by the government for failures of internal controls?
A. President, vice presidents, and other true corporate officers
B. Board of directors, president, vice presidents, department directors, and managers
C. All members of management
D. Board of directors, CEO, CFO, CIO, and department directors
A.
Officers of the organization will typically hold the title of vice president or higher. A CIO might not be a corporate officer, unless the position is located in the parent organization. A division‐level CIO may or may not be a true corporate officer. Those holding the position of department director and below are seldom held liable by the government for internal control failure. A department director is a supporting manager to the vice president.
Which of the following is true concerning the roles of data owner, data user, and data custodian?
A. The data user implements controls as necessary.
B. The data custodian is responsible for specifying acceptable usage.
C. The data owner specifies controls.
D. The data custodian specifies security classification.
C.
The data owner specifies controls, is responsible for acceptable use, and appoints the data custodian. The data users will comply with acceptable use and report violations. The data custodian will protect information and ensure its availability. The custodian will also provide support to the users.
