Which of the following is the FIRST step in an IT risk assessment for a risk-based audit?

Understand the business, its operating model and key processes

The BEST factor for determining the required extent of data collection during the planning of an IS compliance audit is

the purpose, objective and scope of the audit

An IS auditor discovers that numerous PCs contain unauthorized software. Which action should the IS auditor take?

Report usage of the unauthorized software & the need to prevent recurrence

Which of the following is the MAIN reason to perform a risk assessment in the planning phase of an IS audit?

To provide reasonable assurance material items will be addressed

Which is MOST likely be considered a conflict of interest for an IS auditor reviewing a cybersecurity implementation?

Designing the cybersecurity controls

A PRIMARY benefit derived for an organization employing control self-assessment techniques is that it

can identify high-risk areas that might need a detailed review later.

An IS auditor performing an audit of the risk assessment process should FIRST confirm that

assets have been identified and ranked.

An IS auditor has identified a business process to be audited. The IS auditor should NEXT identify the

control objectives and activities.

Which of the following is the PRIMARY requirement for reporting IS audit results? The report is

backed by sufficient and appropriate audit evidence.

The PRIMARY objective of performing a post incident review is that it presents an opportunity to

improve internal control procedures.

An IS auditor should use statistical sampling and not judgmental (non-statistical) sampling, when

the probability of error must be objectively quantified.

An auditee disagrees with an audit finding. Which is the BEST course of action for the IT auditor to take?

Discuss the finding with the IT auditor's manager.

During an exit interview, in cases where there is disagreement regarding the impact of a finding, an IS auditor should

elaborate on the significance of the finding and the risk of not correcting

The MAIN advantage of an IS auditor directly extracting data from a general ledger systems is

greater assurance of data validity

Which should be the FIRST action of an IS auditor during a dispute with a department manager over audit findings?

Revalidate the supporting evidence for the finding.

The MOST appropriate action for an IS auditor to take when shared user accounts are discovered is to:

document the finding and explain the risk of using shared IDs.

Which of the following is the PRIMARY requirement in reporting results of an IS audit? The report is:

backed by sufficient and appropriate audit evidence.

studbud

CISA - Domain 1

25 termsStudBud Administration286 plays

Imported from external platform

Flashcards25 cardsFPractice quizPHost liveL

Questions 25

Answers

1
Which of the following is MOST effective for monitoring transactions exceeding predetermined thresholds?
An integrated test facility
Generalized audit software
Regression tests
Transaction snapshots
2
An IS auditor wants to determine the effectiveness of managing user access to a server room. Which is the BEST evidence?
Review of the procedure manual
Observation of a logged event
Interview with management
Interview with security personnel
3
Which of the following does a lack of adequate controls represent?
An impact
A vulnerability
A threat
An asset
4
Which of the following is the FIRST step in an IT risk assessment for a risk-based audit?
List all controls from the audit program to select ones matching objectives
Understand the business, its operating model and key processes
Identify all IT systems and controls that are relevant to audit objectives
Review the results of a risk self-assessment
5
An IS auditor discovers a potential material finding. The BEST course of action is to
perform additional testing.
increase the scope of the audit.
discuss the potential finding with the audit committee.
report the potential finding to business management.
6
The BEST factor for determining the required extent of data collection during the planning of an IS compliance audit is
the purpose, objective and scope of the audit
the auditor’s familiarity with the organization
the findings and issues noted from the prior year
the complexity of the organization’s operation
7
An IS auditor discovers that numerous PCs contain unauthorized software. Which action should the IS auditor take?
Report usage of the unauthorized software & the need to prevent recurrence
Delete all copies of the unauthorized software.
Recommend automated process to monitor compliance with software licensing
Warn the end users about the risk of using illegal software.
8
Which of the following is the MAIN reason to perform a risk assessment in the planning phase of an IS audit?
To ensure the audit team will perform audits within budget
To provide reasonable assurance material items will be addressed
To develop the audit program and procedures to perform the audit
To ensure management’s concerns are addressed
9
An IS auditor should ensure that review of online electronic funds transfer reconciliation procedures should include
authorizations.
tracing.
vouching.
corrections.
10
Which is MOST likely be considered a conflict of interest for an IS auditor reviewing a cybersecurity implementation?
Conducting the vulnerability assessment
Advising on the cybersecurity framework
Delivering cybersecurity awareness training
Designing the cybersecurity controls
11
A PRIMARY benefit derived for an organization employing control self-assessment techniques is that it
can identify high-risk areas that might need a detailed review later.
can be used as a replacement for traditional audits.
allows management to relinquish responsibility for control.
allows IS auditors to independently assess risk.
12
An IS auditor performing an audit of the risk assessment process should FIRST confirm that
assets have been identified and ranked.
the effects of potential security breaches have been evaluated.
technical and organizational vulnerabilities have been analyzed.
reasonable threats to the information assets are identified.
13
Which of the following sampling methods is MOST useful when testing for compliance?
Attribute sampling
Difference estimation sampling
Variable sampling
Stratified mean per unit sampling
14
An IS auditor has identified a business process to be audited. The IS auditor should NEXT identify the
most valuable information assets.
control objectives and activities.
auditee personnel to be interviewed.
IS audit resources to be deployed.
15
Which of the following is the PRIMARY requirement for reporting IS audit results? The report is
prepared according to a predefined and standard template.
backed by sufficient and appropriate audit evidence.
comprehensive in coverage of enterprise processes.
reviewed and approved by audit management.
16
When developing a risk management program, what is the FIRST activity to be performed?
Criticality analysis
Classification of data
Inventory of assets
Threat assessment
17
The PRIMARY objective of performing a post incident review is that it presents an opportunity to
harden the network to industry good practices.
highlight the importance of incident response management to management.
improve internal control procedures.
improve employee awareness of the incident response process.
18
What is the MAJOR benefit of conducting a control self-assessment over a traditional audit?
It replaces the internal audit function.
It reduces audit workload.
It detects risk sooner.
It reduces audit resource requirements.
19
An IS auditor should use statistical sampling and not judgmental (non-statistical) sampling, when
the tolerable error rate cannot be determined.
the probability of error must be objectively quantified.
the auditor wants to avoid sampling risk.
generalized audit software is unavailable.
20
An auditee disagrees with an audit finding. Which is the BEST course of action for the IT auditor to take?
Discuss the finding with the auditee's manager.
Elevate the risk associated with the control.
Retest the control to confirm the finding.
Discuss the finding with the IT auditor's manager.
21
During an exit interview, in cases where there is disagreement regarding the impact of a finding, an IS auditor should
elaborate on the significance of the finding and the risk of not correcting
accept the auditee's position because they are the process owners
ask the auditee to sign a release form accepting full legal responsibility
report the disagreement to the audit committee for resolution
22
The MAIN advantage of an IS auditor directly extracting data from a general ledger systems is
greater assurance of data validity
greater flexibility for the audit department
reduction in the time to have access to the information.
reduction of human resources needed to support the audit.
23
Which should be the FIRST action of an IS auditor during a dispute with a department manager over audit findings?
Retest the control to validate the finding.
Engage a third party to validate the finding.
Include the finding in the report with the department manager's comments.
Revalidate the supporting evidence for the finding.
24
The MOST appropriate action for an IS auditor to take when shared user accounts are discovered is to:
document the finding and explain the risk of using shared IDs.
request that the IDs be removed from the system.
inform the audit committee of the potential issue.
review audit logs for the IDs in question.
25
Which of the following is the PRIMARY requirement in reporting results of an IS audit? The report is:
backed by sufficient and appropriate audit evidence.
reviewed and approved by audit management.
prepared according to a predefined and standard template.
comprehensive in coverage of enterprise processes.

CISA - Domain 1 Flashcards | StudBud