CISA Information System Auditing Process Practice Test 2 — 15 Questions

Question 1

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Accepted Answer

Testing controls. Fieldwork involves executing audit procedures; walkthroughs and testing controls are part of fieldwork.

Answer

Defining audit scope

Answer

Developing the audit program

Answer

Issuing the draft report

Question 2

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Accepted Answer

Measurable. SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

Answer

General

Answer

Subjective

Question 3

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Accepted Answer

Ratio analysis. Analytical procedures include ratio analysis and trend analysis; inquiry and inspection are other types.

Answer

Inquiry of management

Answer

Inspection of documents

Answer

Observation of process

Question 4

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

Accepted Answer

It focuses audit efforts on areas with the highest risk.. A risk-based approach allows the auditor to focus on areas with higher risk, thereby optimizing the use of audit resources and ensuring that significant risks are addressed.

Answer

It ensures that all controls are tested equally.

Answer

It reduces the overall cost of the audit.

Answer

It guarantees the detection of material misstatements.

Question 5

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

Accepted Answer

A material weakness. A material weakness is a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement will not be prevented or detected.

Answer

An observation

Answer

A deficiency

Answer

A finding

Question 6

An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?

Accepted Answer

Statistical attribute sampling. Statistical sampling (attribute sampling) is appropriate when the auditor wants to draw a conclusion about the population's error rate with a specified confidence level.

Answer

Systematic sampling

Answer

Judgmental sampling

Answer

Stratified sampling

Question 7

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

Accepted Answer

To gain an understanding of the process and identify control points. A walkthrough helps the auditor understand the flow of transactions and identify control points, which aids in assessing control design and identifying risks.

Answer

To test the operating effectiveness of controls

Answer

To collect evidence of control failures

Answer

To identify process owners and key personnel

Question 8

An IS auditor is selecting audit procedures to test controls over user access. Which of the following is an example of a re-performance procedure?

Accepted Answer

Independently creating a test user account and verifying access rights. Re-performance involves the auditor independently performing a control to verify its effectiveness. For access controls, independently adding a test user and verifying access rights is a re-performance.

Answer

Observing the security administrator adding a user

Answer

Reviewing the access control policy document

Answer

Interviewing the security administrator about the process

Question 9

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

Accepted Answer

The risk assessment of the area under review. The scope should be based on a risk assessment to ensure that the audit addresses areas with the highest risk to the organization.

Answer

The availability of audit staff

Answer

The budget approved for the audit

Answer

The results of prior audit findings

Question 10

During the fieldwork phase, an IS auditor discovers that a control is not operating as designed. The auditor reperforms the control and finds that it is effective. Which of the following conclusions is MOST appropriate?

Accepted Answer

The control is operating effectively based on the re-performance.. If the auditor's independent re-performance shows the control is effective, the control is operating effectively, despite the initial indication of a deviation.

Answer

The control design is adequate but implementation is weak.

Answer

The re-performance is not sufficient; additional testing is required.

Answer

The control is not operating effectively because the design was not followed.

Question 11

Which of the following is a key difference between internal and external IS auditors?

Accepted Answer

External auditors are required for regulatory compliance.. External auditors are independent third parties, while internal auditors are employees. Independence is a key factor in objectivity and reliability of audit work.

Answer

Internal auditors perform only operational audits.

Answer

External auditors cannot perform compliance audits.

Answer

Internal auditors have greater independence.

Question 12

An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?

Accepted Answer

Findings, recommendations, and management action plans. The final audit report should include findings, recommendations, and management's action plans to provide a complete picture and enable follow-up.

Answer

Only the audit findings

Answer

Only the recommendations

Answer

The audit program and procedures

Question 13

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

Accepted Answer

Review system documentation and conduct walkthroughs. Reviewing system documentation and conducting walkthroughs allows the auditor to understand the intended design and compare it to actual implementation.

Answer

Use analytical procedures to identify anomalies

Answer

Perform detailed testing of transactions

Answer

Interview management and review policies

Question 14

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

Accepted Answer

The specific requirements of the regulation. For a compliance audit, the criteria are the specific requirements of the regulation or law that the organization must adhere to.

Answer

Prior audit findings

Answer

Industry best practices

Answer

The organization's internal policies

Question 15

During an audit, the IS auditor identifies that the audit team lacks the technical expertise to evaluate a specific system. According to ISACA standards, the auditor should:

Accepted Answer

Engage a subject matter expert with the required skills. If the audit team lacks necessary expertise, the auditor should engage a specialist or subject matter expert to ensure audit quality.

Answer

Skip the evaluation of that system

Answer

Request management to provide training

Answer

Proceed with the audit and document the limitation