CISA Information System Auditing Process Practice Test 5 — 15 Questions

Question 1

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Accepted Answer

Use a risk-based approach to focus on high-risk areas. A risk-based approach prioritizes areas with highest risk, efficient for limited resources.

Answer

Rely solely on inquiry to reduce workload

Answer

Postpone the audit until more staff are available

Answer

Audit all areas equally to ensure full coverage

Question 2

An IS auditor finds that a control deficiency could lead to a material misstatement if combined with another deficiency. How should this be classified?

Accepted Answer

Material weakness. A material weakness is a deficiency, or combination, that results in a reasonable possibility of material misstatement.

Answer

Deficiency

Answer

Observation

Answer

Significant deficiency

Question 3

During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?

Accepted Answer

Investigate the reason for the increase. Analytical procedures identify anomalies; the auditor should investigate the cause before concluding.

Answer

Report the increase as a finding

Answer

Ignore the increase if it is within budget

Answer

Expand the sample size for testing

Question 4

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Accepted Answer

Re-performance of access provisioning using a test account. Re-performance and inspection of audit logs provide direct evidence of control effectiveness.

Answer

Inquiry of the security administrator

Answer

Inspection of user access review documentation

Answer

Observation of access request processing

Question 5

Which THREE factors should an IS auditor consider when determining the sample size for a compliance test? (Select three.)

Accepted Answer

The tolerable error rate. Sample size is influenced by desired confidence, tolerable error rate, and expected error rate.

Answer

The audit budget

Answer

The population size

Question 6

In the audit follow-up phase, which TWO actions are essential? (Select two.)

Accepted Answer

Assess the effectiveness of the corrective actions. Follow-up includes verifying that management has implemented corrective actions and assessing their effectiveness.

Answer

Expand the scope of the original audit

Answer

Re-issue the audit report

Answer

Update the audit program for next year

Question 7

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

Accepted Answer

External audit. External audits are conducted by third-party auditors to provide independent assurance, often required by regulations or standards.

Answer

Operational audit

Answer

IS audit

Answer

Internal audit

Question 8

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. The audit team has limited experience with this ERP. Which of the following is the BEST course of action?

Accepted Answer

Engage an external specialist with ERP expertise to supplement the audit team.. Incorporating an external specialist with ERP expertise ensures the audit is conducted effectively despite the team's lack of experience.

Answer

Limit the audit scope to exclude the new ERP system.

Answer

Proceed with the audit using existing staff and hope for the best.

Answer

Postpone the audit until the team gains sufficient experience.

Question 9

An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?

Accepted Answer

Test the compensating controls to determine if they adequately mitigate the risk.. Assessing the effectiveness of compensating controls is appropriate to determine if the control deficiency is mitigated.

Answer

Increase the sample size for substantive testing to compensate.

Answer

Immediately report the missing control as a material weakness.

Answer

Ignore the missing control since compensating controls exist.

Question 10

Which of the following is the PRIMARY purpose of audit working papers?

Accepted Answer

To support the auditor's conclusions and provide evidence of the work performed.. Working papers document the audit procedures performed, evidence obtained, and conclusions reached, supporting the audit opinion.

Answer

To provide a permanent record of the organization's financial transactions.

Answer

To serve as a basis for the audit fee calculation.

Answer

To replace the need for management's representation letter.

Question 11

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

Accepted Answer

The control is effective as the sample deviation rate is below the tolerable rate.. The sample deviation rate of 4% (2 out of 50) is below the tolerable deviation rate of 5%. Therefore, the control is considered effective based on the sample evidence. The auditor does not need to increase the sample size unless the deviation rate is close to the tolerable rate or other risk factors exist. In this case, the control can be relied upon as designed.

Answer

The auditor should increase the sample size to reduce sampling risk.

Answer

The control is ineffective because deviations were found.

Answer

The auditor should conclude that the control is ineffective and report a deficiency.

Question 12

Which of the following is the BEST example of an analytical procedure used during an IS audit?

Accepted Answer

Comparing current period IT expenses to prior periods and investigating significant variances.. Analytical procedures involve evaluating financial information by studying plausible relationships among data. Comparing current period expenses to prior periods is a typical example.

Answer

Observing the data center's physical security controls.

Answer

Reviewing a sample of change requests for proper authorization.

Answer

Interviewing the IT manager about change management procedures.

Question 13

An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The results of a risk assessment evaluating inherent risk and control effectiveness.. Risk assessment should consider the inherent risk of each unit, including financial impact, complexity, and past issues, to prioritize high-risk areas.

Answer

The geographical location of each business unit.

Answer

The budget allocated to each business unit for IT.

Answer

The number of employees in each business unit.

Question 14

According to ISACA IT Audit Standards, which of the following is a key requirement for audit documentation?

Accepted Answer

Documentation must support the audit findings and conclusions.. Audit documentation must be sufficient to enable an experienced auditor, with no prior connection to the audit, to understand the work performed and conclusions reached.

Answer

Documentation must be retained for at least 10 years.

Answer

Documentation must be reviewed by the audit committee.

Answer

Documentation must be prepared in the local language of the auditee.

Question 15

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

Accepted Answer

Material weakness. A deficiency that could result in a material misstatement is classified as a material weakness.

Answer

Deficiency

Answer

Observation

Answer

Finding