CISA Information System Auditing Process Practice Test 3 — 15 Questions

Question 1

An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?

Accepted Answer

Comparing current-year expenses to prior-year expenses. Analytical procedures involve comparisons of data to expectations, such as comparing current-year data to prior-year data to identify unusual fluctuations.

Answer

Observing the inventory count

Answer

Inspecting authorization forms for signatures

Answer

Confirming account balances with third parties

Question 2

An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?

Accepted Answer

Greater reliance on detective and compensating controls. In small organizations, segregation of duties may be limited, so the auditor should place greater reliance on detective and compensating controls.

Answer

Reduced audit scope because of limited staff

Answer

Increased reliance on preventive controls due to limited staff

Answer

Use of extensive substantive testing to compensate for weak controls

Question 3

After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?

Accepted Answer

To verify that corrective actions have been implemented effectively. Follow-up ensures that management has taken corrective actions to address the findings and that the risks have been mitigated.

Answer

To update the permanent audit file

Answer

To close the audit engagement

Answer

To identify new risks for the next audit

Question 4

An IS auditor is assessing the effectiveness of controls over a critical financial system. Which TWO types of evidence provide the highest level of assurance? (Select TWO.)

Accepted Answer

Re-performance. Re-performance and observation provide direct evidence; re-performance shows the control works, and observation provides witness of execution.

Answer

Inquiry

Answer

Inspection of documentation

Answer

Analytical procedures

Question 5

An IS auditor is performing a risk assessment for an audit of a cloud service provider. Which THREE factors should be considered when assessing inherent risk? (Select THREE.)

Accepted Answer

Complexity of the cloud architecture. Inherent risk is the risk without controls. Factors include complexity, data sensitivity, and changes in the environment.

Answer

Effectiveness of monitoring controls

Answer

Strength of access controls

Question 6

Which TWO of the following are components of audit risk in the ISACA risk model? (Select TWO.)

Accepted Answer

Inherent risk. Audit risk = Inherent risk × Control risk × Detection risk. Inherent risk and detection risk are components; control risk is also a component, but the question asks for two; correct ones are inherent and detection.

Answer

Engagement risk

Answer

Sampling risk

Answer

Business risk

Question 7

Which of the following audit types is most likely to be conducted by an employee of the organization being audited, potentially raising independence concerns?

Accepted Answer

Internal audit. Internal audits are performed by employees of the organization, which can create independence issues. External audits are conducted by third parties.

Answer

IS audit

Answer

Compliance audit

Answer

External audit

Question 8

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. Which of the following actions should the auditor prioritize?

Accepted Answer

Include a review of the ERP system in the audit scope due to the high inherent risk. A risk-based audit approach requires focusing on high-risk areas. A new ERP system introduces significant risks, so it should be prioritized in the audit scope.

Answer

Exclude the ERP system from the audit scope because it is new and not yet stable

Answer

Delay the audit until the ERP system has been fully stabilized for six months

Answer

Focus only on financial reporting controls related to the ERP system

Question 9

An IS auditor is testing the effectiveness of a control that requires dual authorization for all transactions over $10,000. The population consists of 5,000 transactions, of which 250 exceed the threshold. The auditor uses a sample of 50 transactions from the entire population and finds 3 exceptions. What type of sampling method did the auditor use?

Accepted Answer

Judgmental sampling. The auditor selected a sample from the entire population without stratification, and the selection method is not described as random or systematic; however, the description implies a non-statistical judgmental sample. Stratified sampling would require dividing the population into subgroups (e.g., by value).

Answer

Stratified sampling

Answer

Random sampling

Answer

Systematic sampling

Question 10

Which of the following is the best example of audit evidence obtained through re-performance?

Accepted Answer

Recalculating the total of a control report to verify accuracy. Re-performance involves the auditor independently executing a control to verify its effectiveness. The auditor recalculating a control total is a direct re-performance.

Answer

Reviewing log files for unauthorized access attempts

Answer

Interviewing the system administrator about backup procedures

Answer

Observing employees as they process transactions

Question 11

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

Accepted Answer

To provide a basis for the audit report and support the auditor's conclusions. Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

Answer

To facilitate the planning of the next audit

Answer

To serve as a legal record for potential litigation

Answer

To demonstrate compliance with audit standards

Question 12

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

Accepted Answer

Performing trend analysis on the number of transactions processed per hour. Analytical procedures, such as comparing processing times to benchmarks, can identify inefficiencies. Observation may show procedures but not efficiency quantitatively.

Answer

Inspecting system logs to verify user access

Answer

Observing data entry operators to identify procedural bottlenecks

Answer

Interviewing the data entry supervisor about error rates

Question 13

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

Accepted Answer

Low. Audit risk is determined by inherent risk, control risk, and detection risk. The standard audit risk model is: Audit Risk = Inherent Risk × Control Risk × Detection Risk. With inherent risk high, control risk moderate, and detection risk low, the product is low (e.g., High × Moderate × Low = Low). This indicates a low overall audit risk because the auditor plans to perform sufficient substantive procedures to compensate for the high inherent and moderate control risks.

Answer

Moderate

Answer

High

Answer

Cannot be determined

Question 14

Which of the following is a permanent file item in an IS audit working paper?

Accepted Answer

Organizational chart of the IT department. The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts. Current year's audit program is part of the current file.

Answer

Confirmation letters from vendors

Answer

Current year's audit program

Answer

List of audit findings for the current year

Question 15

A compliance audit is primarily concerned with:

Accepted Answer

Determining whether the organization is following applicable laws and regulations. Compliance audits specifically assess adherence to laws, regulations, and policies. Efficiency and effectiveness are the focus of operational audits.

Answer

Evaluating the effectiveness of internal controls

Answer

Assessing the efficiency of IT operations

Answer

Ensuring the organization is meeting its strategic objectives