CISA Information System Auditing Process — All Questions With Answers

Question 1hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing audit risk for a payroll system. The inherent risk is assessed as moderate, control risk as high due to weak segregation of duties, and detection risk is set at low because of extensive substantive testing. What is the impact on overall audit risk?

Question 2easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is selecting audit procedures to test controls over user access. Which of the following is an example of a re-performance procedure?

Question 3hardmultiple choice

Read the full Information System Auditing Process explanation →

During the fieldwork phase, an IS auditor discovers that a control is not operating as designed. The auditor reperforms the control and finds that it is effective. Which of the following conclusions is MOST appropriate?

Question 4mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between internal and external IS auditors?

Question 5mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the effectiveness of controls over a critical financial system. Which TWO types of evidence provide the highest level of assurance? (Select TWO.)

Question 6easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are components of audit risk in the ISACA risk model? (Select TWO.)

Question 7hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing the effectiveness of a control that requires dual authorization for all transactions over $10,000. The population consists of 5,000 transactions, of which 250 exceed the threshold. The auditor uses a sample of 50 transactions from the entire population and finds 3 exceptions. What type of sampling method did the auditor use?

Question 8mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

Question 9hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

Question 10mediummultiple choice

Read the full Information System Auditing Process explanation →

During a risk-based audit, the IS auditor identifies a control deficiency that could lead to a material misstatement in financial reporting. According to standard classification, this is best described as a:

Question 11hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of a purchase-to-pay process. The auditor selects a sample of purchase orders and traces them through the system to verify that controls are properly designed and implemented. This is an example of:

Question 12easymulti select

Read the full Information System Auditing Process explanation →

According to ISACA audit standards, which TWO of the following are phases of the audit process? (Select two.)

Question 13hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor finds that a control deficiency could lead to a material misstatement if combined with another deficiency. How should this be classified?

Question 14hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE factors should an IS auditor consider when determining the sample size for a compliance test? (Select three.)

Question 15easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of audit working papers?

Question 16mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

Question 17mediummultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

Question 18hardmultiple choice

Read the full Information System Auditing Process explanation →

Which of the following best describes audit risk in the context of an IS audit?

Question 19mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

Question 20mediummultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the auditor identifies a control deficiency that could result in a material misstatement. According to ISACA guidelines, this is classified as:

Question 21mediummultiple choice

Read the full Information System Auditing Process explanation →

An external auditor is conducting a compliance audit for a company subject to SOX. Which standard is most relevant for this engagement?

Question 22hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are required components of a SMART recommendation? (Select three.)

Question 23mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of a new financial application. The auditor determines that inherent risk is high due to complex transactions, but control risk is low because of strong automated controls. If detection risk is set at 5%, what is the audit risk?

Question 24easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is MOST likely to be performed by an organization's own employees?

Question 25easymultiple choice

Read the full Information System Auditing Process explanation →

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

Question 26mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a financial system. The auditor identifies that the inherent risk is high due to the complexity of transactions, but control risk is low because of strong automated controls. Which component of audit risk will be MOST affected by the auditor's testing strategy?

Question 27mediummultiple choice

Read the full Information System Auditing Process explanation →

Which type of audit evidence involves the auditor independently performing a control procedure to verify its effectiveness?

Question 28hardmultiple choice

Read the full Information System Auditing Process explanation →

In a risk-based audit approach, which of the following BEST describes how an IS auditor should prioritize audit coverage?

Question 29mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?

Question 30easymultiple choice

Read the full Information System Auditing Process explanation →

Which document is typically included in the permanent file of audit documentation?

Question 31mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit, the auditor uses ratio analysis to compare current year expenses to prior years and industry benchmarks. This is an example of which type of audit evidence?

Question 32hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor identifies a control deficiency that could result in a material misstatement in the financial statements. According to audit reporting standards, this should be classified as:

Question 33mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between internal and external auditors?

Question 34easymultiple choice

Read the full Information System Auditing Process explanation →

What is the primary purpose of the planning phase in an IS audit?

Question 35hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?

Question 36mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a characteristic of non-statistical (judgmental) sampling?

Question 37mediummultiple choice

Read the full Information System Auditing Process explanation →

During the follow-up phase of an audit, the auditor discovers that a previous finding has not been remediated. What is the auditor's BEST course of action?

Question 38mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Question 39hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Question 40mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Question 41easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

Question 42mediummultiple choice

Read the full Information System Auditing Process explanation →

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Question 43hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?

Question 44mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

Question 45mediummultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

Question 46easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Question 47hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

Question 48mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

Question 49easymultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the IS auditor identifies that the audit team lacks the technical expertise to evaluate a specific system. According to ISACA standards, the auditor should:

Question 50mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?

Question 51hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?

Question 52mediummultiple choice

Read the full Information System Auditing Process explanation →

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Question 53hardmulti select

Read the full Information System Auditing Process explanation →

An IS auditor is performing a risk assessment for an audit of a cloud service provider. Which THREE factors should be considered when assessing inherent risk? (Select THREE.)

Question 54easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is most likely to be conducted by an employee of the organization being audited, potentially raising independence concerns?

Question 55mediummultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. Which of the following actions should the auditor prioritize?

Question 56mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the best example of audit evidence obtained through re-performance?

Question 57easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Question 58mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a permanent file item in an IS audit working paper?

Question 59easymultiple choice

Read the full Information System Auditing Process explanation →

A compliance audit is primarily concerned with:

Question 60mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the most reliable form of audit evidence?

Question 61mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Question 62hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)

Question 63easymultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, which of the following is the PRIMARY purpose of conducting a risk assessment?

Question 64mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of a purchase-to-pay process. Which of the following is the auditor most likely trying to achieve?

Question 65mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following types of audit evidence provides the highest level of assurance?

Question 66hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor uses statistical sampling to test a population of 10,000 transactions. The auditor discovers 5 errors in the sample of 200. Which of the following conclusions is most appropriate?

Question 67easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY reason for an external IS audit to be more independent than an internal audit?

Question 68mediummultiple choice

Read the full Information System Auditing Process explanation →

During an operational audit of an IT department, the auditor finds that system uptime is 99.9% but the department missed two critical project deadlines. Which conclusion is most appropriate?

Question 69mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY purpose of audit working papers?

Question 70hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?

Question 71easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is an example of a compliance audit?

Question 72mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Question 73mediummultiple choice

Read the full Information System Auditing Process explanation →

During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?

Question 74mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Question 75mediummulti select

Read the full Information System Auditing Process explanation →

In the audit follow-up phase, which TWO actions are essential? (Select two.)

Question 76easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Question 77mediummultiple choice

Read the full Information System Auditing Process explanation →

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. The audit team has limited experience with this ERP. Which of the following is the BEST course of action?

Question 78hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?

Question 79mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the BEST example of an analytical procedure used during an IS audit?

Question 80hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a decentralized organization with multiple business units. The auditor wants to use a risk-based approach. Which of the following is the MOST appropriate factor to prioritize audit coverage?

Question 81easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which of the following is a key requirement for audit documentation?

Question 82mediummultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is a key difference between an internal audit and an external audit?

Question 83hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of data privacy regulations. The auditor finds that the organization's privacy policy is not fully aligned with regulatory requirements. Which of the following is the auditor's BEST course of action?

Question 84easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following evidence types involves the auditor independently performing a control procedure to verify its effectiveness?

Question 85mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of statistical sampling methods? (Select TWO.)

Question 86hardmulti select

Read the full Information System Auditing Process explanation →

Which THREE of the following are phases of the audit process as defined by ISACA? (Select THREE.)

Question 87mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the effectiveness of controls over a critical financial application. Which TWO of the following are appropriate audit procedures to test the design and implementation of controls? (Select TWO.)

Question 88mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?

Question 89easymultiple choice

Read the full Information System Auditing Process explanation →

Which of the following is the PRIMARY reason an external audit is considered more independent than an internal audit?

Question 90hardmultiple choice

Read the full Information System Auditing Process explanation →

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

Question 91mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a walkthrough of the accounts payable process. Which audit procedure is the auditor primarily executing?

Question 92easymultiple choice

Read the full Information System Auditing Process explanation →

According to ISACA IT Audit Standards, which phase of the audit process includes the development of an audit programme?

Question 93mediummultiple choice

Read the full Information System Auditing Process explanation →

An auditor is selecting a sample of purchase orders for testing. The auditor decides to select every 50th purchase order from a list. This is an example of:

Question 94easymultiple choice

Read the full Information System Auditing Process explanation →

Which type of audit is primarily concerned with evaluating the efficiency and effectiveness of operations?

Question 95hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is preparing working papers. Which of the following items should be included in the permanent file rather than the current file?

Question 96mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of analytical procedures used in an IS audit? (Select two.)

Question 97easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are phases of the audit process? (Select two.)

Question 98easymultiple choice

Read the full Information System Auditing Process explanation →

During which phase of the IS audit process does the auditor perform walkthroughs and test controls?

Question 99hardmultiple choice

Read the full Information System Auditing Process explanation →

Which of the following best describes the primary advantage of using statistical sampling over non-statistical sampling in an IS audit?

Question 100mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is performing a compliance audit of a company's data privacy practices. Which type of evidence would be most appropriate to verify that employees have completed mandatory privacy training?

Question 101hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the audit documentation from a prior year and finds that a material weakness was reported but not remediated. According to ISACA standards, which audit phase should address this?

Question 102easymulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are types of audit evidence recognized in IS audit practice?

Question 103mediummulti select

Read the full Information System Auditing Process explanation →

Which TWO of the following are components of audit risk in IS auditing?

Question 104easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is conducting a preliminary review of a newly acquired subsidiary and needs to understand the organizational structure, key business processes, and the technology environment before drafting the engagement plan. Which of the following techniques is MOST appropriate for gathering this broad understanding?

Question 105mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is conducting a follow-up review of prior audit findings. Management has implemented a new automated control but has not yet updated the risk register to reflect the residual risk. Which of the following should the auditor do FIRST?

Question 106mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is leading an audit engagement and discovers that a key member of the audit team lacks the technical expertise to evaluate a newly implemented cloud encryption control. The audit manager insists the team member proceed anyway to save time. According to ISACA IT Audit Standards, what is the MOST appropriate action for the IS auditor to take?

Question 107mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is documenting the audit programme for an engagement and must decide how specific the procedures should be. Which of the following BEST describes the appropriate level of detail for procedures recorded in the audit programme?

Question 108mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is conducting an audit of a hospital's electronic health record system. During fieldwork, the auditor discovers that several database administrators have the ability to modify patient records directly in the production database without leaving an audit trail. The auditor wants to gather sufficient appropriate evidence to determine whether this is a widespread issue. Which of the following is the MOST appropriate action?

Question 109mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is conducting a follow-up review of a previously identified high-risk finding. Management has implemented a compensating control instead of the recommended control. Which of the following is the MOST appropriate action for the auditor to take?

Question 110hardmultiple choice

Study the full ACL explanation →

An IS auditor is reviewing a network access control list and finds that a rule permits traffic from any source to a database server on port 1521. Management states the rule is required for a legacy application. Which of the following is the MOST appropriate audit response?

Question 111easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the audit charter of an organization's internal audit function. Which of the following should the auditor expect to find as the PRIMARY purpose of the audit charter?

Question 112easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a data center and must decide whether to test controls or rely on the work of the organization's internal audit function. Which of the following is the MOST important activity before the auditor can rely on that work?

Question 113easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the audit committee's oversight of the IT audit function. The auditor notes that the audit committee approves the annual IT audit plan but does not receive regular updates on the status of management's remediation of audit findings. Which of the following is the MOST significant risk arising from this situation?

Question 114mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the sufficiency of audit evidence gathered for a conclusion about database access controls. Which TWO of the following characteristics must the evidence possess to be considered appropriate? (Choose two.)

Question 115hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the risk of material misstatement in a highly automated transaction processing environment. The auditor notes that the system automatically calculates interest and posts it to customer accounts. Which of the following audit approaches would BEST address the risk of incorrect interest calculations?

Question 116mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the reliability of audit evidence obtained during a review of an outsourced payroll provider. Which TWO of the following considerations most directly affect the reliability of that evidence? (Choose two.)

Question 117hardmultiple choice

Read the full Information System Auditing Process explanation →

During a follow-up audit, an IS auditor finds that management implemented a compensating control rather than the recommended primary control to address a previously reported high-risk finding. The residual risk is now within the organization's risk appetite. How should the IS auditor respond?

Question 118mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is executing a compliance test of change management controls over a core banking application. The audit programme requires evidence that all production changes were approved before implementation. Which of the following techniques provides the MOST persuasive evidence for this test?

Question 119mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning a compliance audit of a payment gateway that processes credit card transactions. The auditor needs to determine whether the control environment meets the requirements of the applicable payment card industry standard. Which of the following should be the auditor's PRIMARY basis for defining the audit criteria?

Question 120mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is conducting an audit of a payroll application and selects a statistical sample of 200 payment transactions from a population of 20,000. Testing reveals 12 transactions where the gross pay was calculated incorrectly due to a flawed overtime rule. Which of the following is the MOST appropriate interpretation of this result?

Question 121hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating a control that requires the security administrator to review privileged access logs weekly. During testing, the auditor finds the reviews were performed but no evidence of follow-up exists for two anomalies identified in one review. Which of the following conclusions is MOST appropriate?

Question 122hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the reliability of evidence obtained from a system-generated exception report. The report is produced by a script written by a database administrator who has both the ability to modify the script and the production data. The auditor has obtained the report directly from the system. Which of the following is the MOST important factor affecting the auditor's reliance on this evidence?

Question 123easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing the audit committee's oversight of the IT audit function. Which of the following is the MOST important factor for the auditor to consider when assessing the committee's effectiveness?

Question 124easymultiple choice

Read the full Information System Auditing Process explanation →

During an audit of a data center, the IS auditor observes that visitors are escorted at all times but the visitor log is not reconciled to the badge access system. Which of the following BEST describes the audit concern?

Question 125hardmulti select

Read the full Information System Auditing Process explanation →

An IS auditor is designing substantive test procedures for a newly implemented automated accounts payable system and wants to rely less on the client's automated controls. The auditor decides to use computer-assisted audit techniques to test the completeness and accuracy of transaction processing. Which TWO of the following techniques would BEST provide direct evidence about the population of transactions? (Choose two.)

Question 126mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an engagement and needs to obtain an understanding of the organization's IT environment to develop the audit programme. Which of the following techniques is MOST appropriate for this purpose?

Question 127hardmultiple choice

Read the full Information System Auditing Process explanation →

During an audit of a data center, an IS auditor discovers that a critical server's operating system has not been patched for eight months because the vendor's patch conflicted with a legacy application. Management accepts the risk and documents a compensating control of enhanced network monitoring. Which of the following should the IS auditor do NEXT?

Question 128hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning the use of computer-assisted audit techniques (CAATs) to test a large transaction population for duplicate payments. Which of the following is the MOST important consideration before relying on the CAAT results?

Question 129hardmultiple choice

Read the full Information System Auditing Process explanation →

During an audit of a bank's online transaction processing system, the IS auditor discovers that batch totals are reconciled only at the end of each business day, while individual transactions are posted to customer accounts in real time. Which of the following is the GREATEST risk arising from this control design?

Question 130mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the effectiveness of the change management process for a critical financial application. The auditor wants to determine whether changes are adequately tested before being deployed to production. Which TWO of the following procedures would provide the MOST relevant evidence? (Choose two.)

Question 131hardmulti select

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the reliability of audit evidence obtained from an IT system. Which TWO of the following factors most directly affect the reliability of the evidence? (Choose two.)

Question 132mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a cloud-hosted application and needs to determine whether the cloud provider's controls are adequate. The provider offers a SOC 2 Type II report. Which of the following should the auditor do FIRST?

Question 133easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor has completed fieldwork for an audit of a data center's physical access controls and has documented several findings. Before drafting the final report, the auditor discusses the findings with the data center manager. Which of the following is the PRIMARY purpose of this discussion?

Question 134mediummulti select

Read the full Information System Auditing Process explanation →

An IS auditor is performing a risk assessment to prioritize audit engagements for the annual audit plan. Which TWO of the following factors should the auditor consider when evaluating inherent risk? (Choose two.)

Question 135easymultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is conducting an audit of a payroll application and needs to verify that user access rights match each employee's current job responsibilities. Which of the following is the MOST appropriate source of evidence for this test?

Question 136mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is evaluating the results of a penetration test performed by an external vendor on a web-facing application. The report identifies a critical SQL injection vulnerability. Which of the following is the MOST appropriate action for the IS auditor to recommend FIRST?

Question 137mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a cloud service provider's controls over data backup and recovery. The auditor needs to obtain evidence about the provider's backup procedures and restoration testing. Which of the following is the MOST appropriate source of evidence?

Question 138mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is planning an audit of a cloud service provider's security controls. The auditor has limited access to the provider's internal systems. Which of the following would be the MOST effective way to obtain assurance over the provider's security controls?

Question 139hardmultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is assessing the audit risk for an engagement covering a core banking application. The auditor determines that inherent risk is high because the application processes high-value transactions in real time. The auditor also concludes that control risk is low because strong automated controls and segregation of duties are in place and have been tested. Which of the following BEST describes the appropriate response to this assessment?

Question 140mediummultiple choice

Read the full Information System Auditing Process explanation →

An IS auditor is preparing the audit report after completing fieldwork on an organization's backup and restoration process. Management disagrees with one of the findings and has provided additional evidence. Which of the following is the auditor's MOST appropriate course of action?

Question 141hardmulti select

Read the full Information System Auditing Process explanation →

An IS auditor is reviewing an organization's incident management process after a ransomware attack encrypted several file servers. Which TWO of the following should the auditor verify as part of assessing the effectiveness of the incident response? (Choose two.)

Question 142mediummultiple choice

Read the full Information System Auditing Process explanation →

During an audit of an organization's backup and recovery process, the IS auditor finds that full backups are performed weekly and incremental backups are performed nightly. Restoration testing has not been performed in over two years. Which of the following should the auditor do FIRST?

Question 143hardmulti select

Read the full Information System Auditing Process explanation →

An IS auditor is designing test procedures for an audit of an organization's network perimeter. The auditor plans to use computer-assisted audit techniques (CAATs) to analyze firewall log data covering six months. Which TWO of the following are the MOST important considerations when using CAATs in this engagement? (Choose two.)