CISA Information System Auditing Process Practice Test 8 — 15 Questions

Question 1

An IS auditor is leading an audit engagement and discovers that a key member of the audit team lacks the technical expertise to evaluate a newly implemented cloud encryption control. The audit manager insists the team member proceed anyway to save time. According to ISACA IT Audit Standards, what is the MOST appropriate action for the IS auditor to take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obtain the necessary expertise through additional training or by engaging a qualified specialist.. ISACA IT Audit Standards require that the audit team collectively possess the competencies needed for the engagement. When a specific technical skill is missing, the auditor should acquire it through training or engage a qualified specialist. This preserves the validity of the audit opinion and satisfies professional standards. Proceeding with known incompetence, reassigning the entire engagement, or expanding scope does not remedy the underlying proficiency deficiency.

Answer

Proceed with the audit as planned and note the limitation in the audit report.

Answer

Delegate the entire engagement to the audit manager who has more experience.

Answer

Expand the audit scope to include additional systems to compensate for the knowledge gap.

Question 2

An IS auditor is documenting the audit programme for an engagement and must decide how specific the procedures should be. Which of the following BEST describes the appropriate level of detail for procedures recorded in the audit programme?

Accepted Answer

Specific steps identifying what is to be tested, how, and by whom. An audit programme converts engagement objectives into executable procedures. Each step should state the procedure, the items or population to which it applies, the evidence expected, and who performs it, so that work can be supervised, reviewed, and evidenced. Objectives, prior findings, and criteria inform the programme but do not replace the specific procedural detail that makes the engagement repeatable and defensible.

Answer

Broad control objectives that allow the auditor to choose procedures during fieldwork

Answer

The final audit opinion and the criteria against which it will be measured

Answer

A list of prior audit findings to be re-verified in the current engagement

Question 3

An IS auditor is conducting an audit of a hospital's electronic health record system. During fieldwork, the auditor discovers that several database administrators have the ability to modify patient records directly in the production database without leaving an audit trail. The auditor wants to gather sufficient appropriate evidence to determine whether this is a widespread issue. Which of the following is the MOST appropriate action?

Accepted Answer

Use audit software to examine database user access rights and review system logs for evidence of direct modifications.. The auditor needs evidence about the actual access rights and logging behavior across all database administrators. Using audit software to examine user rights and review logs directly tests the control environment and provides reliable, population-wide evidence. Inquiry and inspection of documents are indirect and cannot confirm the technical capability or the absence of audit trails, while a single observation lacks coverage.

Answer

Review the database administrators' job descriptions to determine if their roles include direct data modification responsibilities.

Answer

Interview the IT manager to confirm whether the database administrators have been authorized to modify records directly.

Answer

Observe a database administrator performing a routine update to confirm whether an audit trail is generated.

Question 4

An IS auditor is conducting a follow-up review of a previously identified high-risk finding. Management has implemented a compensating control instead of the recommended control. Which of the following is the MOST appropriate action for the auditor to take?

Accepted Answer

Evaluate and test the compensating control to determine whether it effectively mitigates the risk.. In follow-up audits, when management implements a compensating control instead of the originally recommended control, the IS auditor must assess whether the alternative control effectively mitigates the identified risk. This requires testing the design and operating effectiveness of the compensating control. If it is found to be effective, the auditor can consider the finding resolved. If not, the finding remains open and may be escalated. Simply accepting or rejecting without evaluation is inappropriate.

Answer

Report to the audit committee that management has failed to implement the recommended control.

Answer

Reissue the original finding with a revised due date for implementation of the recommended control.

Answer

Accept the compensating control as a satisfactory resolution without further testing.

Question 5

An IS auditor is reviewing a network access control list and finds that a rule permits traffic from any source to a database server on port 1521. Management states the rule is required for a legacy application. Which of the following is the MOST appropriate audit response?

Accepted Answer

Document the rule as a finding with a recommendation to restrict source addresses to the application servers.. The auditor should identify the exposure created by an unrestricted database access rule and communicate it with a practical recommendation. Restricting the source addresses maintains the legacy application's function while reducing risk. Auditors report and recommend; they do not implement changes or accept risks on management's behalf. Escalation should follow the normal reporting process.

Answer

Remove the rule immediately to eliminate the exposure.

Answer

Accept the rule because management has provided a documented business justification.

Answer

Escalate the matter directly to the board of directors without further analysis.

Question 6

An IS auditor is reviewing the audit charter of an organization's internal audit function. Which of the following should the auditor expect to find as the PRIMARY purpose of the audit charter?

Accepted Answer

The mandate, authority, and scope of the internal audit function.. An audit charter is the governing document approved by the board or audit committee that establishes the internal audit function's purpose, authority, and scope. It grants the function its mandate and right of access to records, people, and assets. Audit schedules, personnel qualifications, and testing procedures are handled through the annual plan, HR policies, and audit programmes respectively, not the charter.

Answer

The qualifications and certifications required of each auditor on staff.

Answer

The specific testing procedures to be applied during each engagement.

Answer

A detailed schedule of audits planned for the next fiscal year.

Question 7

An IS auditor is planning an audit of a data center and must decide whether to test controls or rely on the work of the organization's internal audit function. Which of the following is the MOST important activity before the auditor can rely on that work?

Accepted Answer

Evaluating the competence, objectivity, and quality of the internal auditors' work. Before relying on the work of internal audit, the IS auditor must determine that the function is competent and objective and that its work is of adequate quality. This evaluation supports a decision to reduce, but not eliminate, the auditor's own procedures. The other listed activities do not establish the professional reliability of the internal audit work being considered.

Answer

Obtaining a representation letter from the internal audit director confirming all findings were reported

Answer

Confirming that the internal audit function uses the same audit software tools as the IS auditor

Answer

Verifying that the internal audit function reports administratively to the audit committee of the board

Question 8

An IS auditor is reviewing the audit committee's oversight of the IT audit function. The auditor notes that the audit committee approves the annual IT audit plan but does not receive regular updates on the status of management's remediation of audit findings. Which of the following is the MOST significant risk arising from this situation?

Accepted Answer

Management may fail to address significant control weaknesses in a timely manner.. The audit committee's oversight role includes monitoring management's progress in addressing audit findings. Without regular remediation updates, the committee cannot ensure that significant control weaknesses are corrected promptly. This creates a governance gap where unresolved risks persist, making the failure to remediate timely the most significant consequence of the described situation.

Answer

The auditor may not be able to perform follow-up activities on previous audit findings.

Answer

The IT audit function may not have sufficient resources to complete the audit plan.

Answer

The IT audit plan may not align with the organization's strategic objectives.

Question 9

An IS auditor is assessing the sufficiency of audit evidence gathered for a conclusion about database access controls. Which TWO of the following characteristics must the evidence possess to be considered appropriate? (Choose two.)

Accepted Answer

Relevance to the control objective being tested. Appropriateness of audit evidence is judged by relevance and reliability. Relevance ties the evidence to the specific control objective, while reliability reflects the source and how the evidence was obtained, with independent, system-generated data generally ranking higher than auditee representations. Sufficiency, by contrast, concerns quantity and is influenced by risk and materiality, so fixed sample counts or retention practices do not make evidence appropriate.

Answer

A minimum sample size of thirty items drawn from the population

Answer

Agreement of the evidence with management's written assertions

Answer

Permanent retention of the evidence in the engagement file

Question 10

An IS auditor is assessing the risk of material misstatement in a highly automated transaction processing environment. The auditor notes that the system automatically calculates interest and posts it to customer accounts. Which of the following audit approaches would BEST address the risk of incorrect interest calculations?

Accepted Answer

Review and test the application's interest calculation logic and related change controls.. In a highly automated transaction processing environment, the most effective audit approach to address the risk of incorrect interest calculations is to review and test the application's calculation logic and the related change controls. This provides assurance that the automated calculations are correct and that any changes are properly authorized, tested, and implemented. Substantive testing alone may not detect systematic errors and is less efficient. Relying on IT's QA lacks independence. Increasing sample size does not address root cause.

Answer

Increase the sample size for substantive testing to achieve a higher confidence level.

Answer

Rely on the IT department's quality assurance testing of the interest calculation module.

Answer

Perform substantive testing of a sample of interest calculations using an independent tool.

Question 11

An IS auditor is evaluating the reliability of audit evidence obtained during a review of an outsourced payroll provider. Which TWO of the following considerations most directly affect the reliability of that evidence? (Choose two.)

Accepted Answer

Whether the evidence is supported by an independent third-party assurance report, such as a SOC 2 report.. Reliability of evidence is driven primarily by the independence of the source and the auditor's direct involvement in obtaining it. Evidence obtained directly by the auditor and evidence corroborated by an independent assurance report are the strongest here. Verbal representations and storage location do not enhance reliability, and timeliness speaks to relevance more than reliability.

Answer

Whether the vendor's management has verbally confirmed the accuracy of the evidence.

Answer

Whether the evidence is stored in the auditor's working paper repository.

Answer

Whether the evidence was collected within the current audit period.

Question 12

During a follow-up audit, an IS auditor finds that management implemented a compensating control rather than the recommended primary control to address a previously reported high-risk finding. The residual risk is now within the organization's risk appetite. How should the IS auditor respond?

Accepted Answer

Evaluate whether the compensating control adequately mitigates the risk and close the finding if it does.. Audit recommendations describe a desired risk outcome, not a mandatory control design. When management implements a compensating control that reduces residual risk to within the organization's risk appetite, the auditor should evaluate whether that control adequately mitigates the risk and close the finding if it does. Reopening, escalating, or mislabeling the response as risk acceptance would misrepresent the outcome and ignore management's ownership of risk.

Answer

Escalate the matter to the audit committee because a compensating control was used.

Answer

Document that management accepted the risk without implementing the recommended control.

Answer

Reopen the original finding because the recommended control was not implemented as specified.

Question 13

An IS auditor is executing a compliance test of change management controls over a core banking application. The audit programme requires evidence that all production changes were approved before implementation. Which of the following techniques provides the MOST persuasive evidence for this test?

Accepted Answer

Inspecting the change tickets for documented approvals and comparing approval dates to deployment dates. Documentary evidence of approvals linked to deployment records directly addresses the control objective: approvals occurring before implementation. Comparing dates on the change tickets themselves allows the auditor to identify exceptions rather than relying on what people say or what policy intends. Interviews, policy review, and single-meeting observation each provide weaker or incomplete evidence for concluding on operating effectiveness across the change population.

Answer

Observing the change advisory board during one weekly meeting

Answer

Reviewing the change management policy approved by the IT steering committee

Answer

Interviewing the change manager about the approval workflow

Question 14

An IS auditor is planning a compliance audit of a payment gateway that processes credit card transactions. The auditor needs to determine whether the control environment meets the requirements of the applicable payment card industry standard. Which of the following should be the auditor's PRIMARY basis for defining the audit criteria?

Accepted Answer

The requirements of the applicable payment card industry data security standard. A compliance audit measures the subject against authoritative criteria imposed by an external body. Because the payment gateway processes cardholder data, the applicable payment card industry data security standard supplies the mandatory requirements the auditor must test. Internal policies, professional judgment, and peer benchmarks inform the work but cannot establish compliance with the governing standard, so they cannot serve as the primary criteria for this engagement.

Answer

The organization's internal information security policy manual and procedures

Answer

A benchmark of security controls adopted by similar payment processors in the same region

Answer

The auditor's professional judgment of what constitutes adequate security for payment gateways

Question 15

An IS auditor is conducting an audit of a payroll application and selects a statistical sample of 200 payment transactions from a population of 20,000. Testing reveals 12 transactions where the gross pay was calculated incorrectly due to a flawed overtime rule. Which of the following is the MOST appropriate interpretation of this result?

Accepted Answer

The error rate in the sample should be projected to the population and evaluated against the tolerable deviation rate. When testing attributes or compliance, the auditor projects the sample deviation rate to the population and compares it with the tolerable deviation rate established during planning. The finding of 12 deviations in 200 items yields a 6 percent rate that must be evaluated against that threshold, along with sampling risk, before determining whether the control can be relied upon.

Answer

The sample size should be increased until the number of exceptions falls within acceptable limits

Answer

The audit conclusion should be unqualified because 188 of 200 transactions were processed correctly

Answer

The 12 identified transactions should be corrected and the sample re-tested to confirm the control is now effective