Courseiva

CCNA Information System Auditing Process Questions

75 of 103 questions · Page 1/2 · Information System Auditing Process · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

An IS auditor is performing a walkthrough of a purchase-to-pay process. The auditor selects a sample of purchase orders and traces them through the system to verify that controls are properly designed and implemented. This is an example of:

A.Walkthrough
B.Analytical procedure
C.Test of controls
D.Substantive testing
AnswerA

A walkthrough is a procedure to understand and confirm the process flow.

Why this answer

A walkthrough involves tracing a transaction through the entire process to confirm understanding and assess control design. It combines inquiry, observation, and inspection.

Practice this question →
2
MCQhard

An IS auditor finds that a control deficiency could lead to a material misstatement if combined with another deficiency. How should this be classified?

A.Deficiency
B.Observation
C.Significant deficiency
D.Material weakness
AnswerD

Combined deficiencies that could lead to material misstatement meet the definition.

Why this answer

A material weakness is a deficiency, or combination, that results in a reasonable possibility of material misstatement.

Practice this question →
3
MCQhard

An IS auditor is performing a compliance audit of data privacy regulations. The auditor finds that the organization's privacy policy is not fully aligned with regulatory requirements. Which of the following is the auditor's BEST course of action?

A.Ignore the issue because the policy is only a minor deviation.
B.Report the finding as a non-compliance issue and recommend updates to the policy.
C.Draft a new privacy policy for the organization.
D.Conclude that the organization is compliant because the policy exists.
AnswerB

This aligns with the audit's objective.

Why this answer

The auditor should report the non-compliance finding and recommend corrective actions, as the primary goal of a compliance audit is to identify gaps.

Practice this question →
4
MCQeasy

An IS auditor is planning an audit of an organization's IT infrastructure. Which of the following is the PRIMARY benefit of using a risk-based approach?

A.It ensures that all controls are tested equally.
B.It reduces the overall cost of the audit.
C.It focuses audit efforts on areas with the highest risk.
D.It guarantees the detection of material misstatements.
AnswerC

Correct; the risk-based approach directs resources to areas of greatest risk.

Why this answer

A risk-based approach allows the auditor to focus on areas with higher risk, thereby optimizing the use of audit resources and ensuring that significant risks are addressed.

Practice this question →
5
MCQmedium

Which of the following is the BEST example of an analytical procedure used during an IS audit?

A.Observing the data center's physical security controls.
B.Reviewing a sample of change requests for proper authorization.
C.Comparing current period IT expenses to prior periods and investigating significant variances.
D.Interviewing the IT manager about change management procedures.
AnswerC

This is an analytical procedure that identifies unusual trends.

Why this answer

Analytical procedures involve evaluating financial information by studying plausible relationships among data. Comparing current period expenses to prior periods is a typical example.

Practice this question →
6
Multi-Selecteasy

Which TWO of the following are components of audit risk in the ISACA risk model? (Select TWO.)

Select 2 answers
A.Inherent risk
B.Engagement risk
C.Sampling risk
D.Detection risk
E.Business risk
AnswersA, D

Correct; inherent risk is a component.

Why this answer

Audit risk = Inherent risk × Control risk × Detection risk. Inherent risk and detection risk are components; control risk is also a component, but the question asks for two; correct ones are inherent and detection.

Practice this question →
7
MCQeasy

According to ISACA IT Audit Standards, which of the following is the primary purpose of audit documentation (working papers)?

A.To facilitate the planning of the next audit
B.To serve as a legal record for potential litigation
C.To provide a basis for the audit report and support the auditor's conclusions
D.To demonstrate compliance with audit standards
AnswerC

Working papers document the evidence and reasoning behind conclusions.

Why this answer

Audit documentation supports the auditor's conclusions and provides evidence of the work performed. It is not primarily for future audit planning or legal protection.

Practice this question →
8
MCQhard

An IS auditor is evaluating the effectiveness of a control. The auditor observes the control being performed and then independently performs the same control to confirm the result. Which combination of evidence types is being used?

A.Inquiry and inspection
B.Inspection and observation
C.Analytical procedures and inquiry
D.Observation and re-performance
AnswerD

Observation sees the process; re-performance tests it.

Why this answer

Observation (watching) and re-performance (doing) are both used to test control effectiveness.

Practice this question →
9
MCQeasy

Which of the following audit types is performed by an independent third-party auditor and is typically required for regulatory compliance?

A.External audit
B.Operational audit
C.IS audit
D.Internal audit
AnswerA

External audits are performed by third-party auditors for independent assurance.

Why this answer

External audits are conducted by third-party auditors to provide independent assurance, often required by regulations or standards.

Practice this question →
10
MCQeasy

During the planning phase of an IS audit, which of the following is the PRIMARY purpose of conducting a risk assessment?

A.To determine the audit budget
B.To obtain management approval
C.To select the audit team members
D.To identify high-risk areas for audit focus
AnswerD

Risk assessment drives audit scope and resource allocation.

Why this answer

A risk assessment identifies high-risk areas to prioritize audit efforts and allocate resources effectively.

Practice this question →
11
MCQeasy

According to ISACA IT Audit Standards, which phase of the audit process includes the development of an audit programme?

A.Planning
B.Reporting
C.Fieldwork
D.Follow-up
AnswerA

Correct phase.

Why this answer

The planning phase includes defining scope, risk assessment, and developing the audit programme.

Practice this question →
12
Multi-Selectmedium

Which TWO of the following are components of audit risk in IS auditing?

Select 2 answers
A.Detection risk
B.Financial risk
C.Business risk
D.Inherent risk
E.Operational risk
AnswersA, D

Detection risk is the risk that procedures fail to detect a misstatement.

Why this answer

Audit risk consists of inherent risk, control risk, and detection risk. The question asks for TWO; inherent and detection are correct.

Practice this question →
13
MCQeasy

A compliance audit is primarily concerned with:

A.Evaluating the effectiveness of internal controls
B.Assessing the efficiency of IT operations
C.Ensuring the organization is meeting its strategic objectives
D.Determining whether the organization is following applicable laws and regulations
AnswerD

Compliance audits verify adherence to external and internal requirements.

Why this answer

Compliance audits specifically assess adherence to laws, regulations, and policies. Efficiency and effectiveness are the focus of operational audits.

Practice this question →
14
MCQmedium

An IS auditor is performing a compliance audit of a company's data privacy practices. Which type of evidence would be most appropriate to verify that employees have completed mandatory privacy training?

A.Inspection of training completion records
B.Observation of a training session
C.Inquiry with the HR manager
D.Analytical procedures comparing training completion rates
AnswerA

Inspection provides direct documentary evidence of each employee's completion.

Why this answer

Inspection of training records provides documentary evidence of completion, which is more reliable than inquiry or observation for verifying compliance.

Practice this question →
15
MCQhard

An IS auditor is assessing the risk of fraud in a financial system. Which combination of audit risk components is most directly relevant?

A.Control risk and detection risk only
B.Inherent risk and detection risk only
C.Inherent risk, control risk, and detection risk
D.Inherent risk and control risk only
AnswerC

All three components affect audit risk.

Why this answer

Audit risk = inherent risk × control risk × detection risk; all three combine to determine overall risk.

Practice this question →
16
MCQmedium

During an IS audit, the auditor finds that a control deficiency could result in a material misstatement. According to ISACA standards, this should be classified as:

A.An observation
B.A deficiency
C.A finding
D.A material weakness
AnswerD

Correct; a material weakness is a deficiency that could result in material misstatement.

Why this answer

A material weakness is a deficiency or combination of deficiencies that results in a reasonable possibility that a material misstatement will not be prevented or detected.

Practice this question →
17
MCQmedium

During an audit, the auditor identifies a control deficiency that could result in a material misstatement. According to ISACA guidelines, this is classified as:

A.Finding
B.Deficiency
C.Observation
D.Material weakness
AnswerD

Correct classification.

Why this answer

A material weakness is a deficiency that could result in a material misstatement.

Practice this question →
18
MCQeasy

Which of the following is the PRIMARY reason for an external IS audit to be more independent than an internal audit?

A.External auditors follow stricter standards
B.External auditors are not employees of the organization
C.External auditors have more industry knowledge
D.External auditors have more resources
AnswerB

Lack of employment relationship enhances objectivity.

Why this answer

External auditors are not employees, reducing organizational pressures and biases.

Practice this question →
19
MCQeasy

According to ISACA IT Audit Standards, which of the following is a key requirement for audit documentation?

A.Documentation must support the audit findings and conclusions.
B.Documentation must be retained for at least 10 years.
C.Documentation must be reviewed by the audit committee.
D.Documentation must be prepared in the local language of the auditee.
AnswerA

This is a fundamental requirement of audit documentation.

Why this answer

Audit documentation must be sufficient to enable an experienced auditor, with no prior connection to the audit, to understand the work performed and conclusions reached.

Practice this question →
20
MCQmedium

According to ISACA IT Audit Standards, which of the following is the MOST important consideration when determining the scope of an IS audit?

A.The availability of audit staff
B.The budget approved for the audit
C.The risk assessment of the area under review
D.The results of prior audit findings
AnswerC

Correct; risk assessment is the basis for scoping.

Why this answer

The scope should be based on a risk assessment to ensure that the audit addresses areas with the highest risk to the organization.

Practice this question →
21
Multi-Selectmedium

An IS auditor is evaluating the effectiveness of controls over a critical financial application. Which TWO of the following are appropriate audit procedures to test the design and implementation of controls? (Select TWO.)

Select 2 answers
A.Performing a walkthrough of the control process.
B.Performing a penetration test on the application.
C.Sending a confirmation letter to the vendor.
D.Calculating the return on investment for the application.
E.Inspecting the control documentation and procedure manuals.
AnswersA, E

Walkthroughs help understand the control flow.

Why this answer

Walkthroughs and inspection of documentation are common procedures to evaluate design and implementation.

Practice this question →
22
MCQmedium

Which of the following is the PRIMARY purpose of audit working papers?

A.To facilitate peer review of the audit
B.To serve as a legal record of the audit
C.To store historical data for future audits
D.To provide a basis for the audit report
AnswerD

Working papers support findings and conclusions.

Why this answer

Working papers document audit procedures, evidence, and conclusions to support the audit opinion.

Practice this question →
23
MCQhard

An IS auditor identifies a control deficiency that could result in a material misstatement in the financial statements. According to audit reporting standards, this should be classified as:

A.Finding
B.Deficiency
C.Observation
D.Material weakness
AnswerD

A material weakness is the most severe classification.

Why this answer

A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Practice this question →
24
MCQmedium

Which of the following is the best example of audit evidence obtained through re-performance?

A.Reviewing log files for unauthorized access attempts
B.Interviewing the system administrator about backup procedures
C.Observing employees as they process transactions
D.Recalculating the total of a control report to verify accuracy
AnswerD

Re-performance involves the auditor independently performing the control.

Why this answer

Re-performance involves the auditor independently executing a control to verify its effectiveness. The auditor recalculating a control total is a direct re-performance.

Practice this question →
25
Multi-Selecthard

Which THREE of the following are required components of a SMART recommendation? (Select three.)

Select 3 answers
A.Auditable
B.Cost-effective
C.Specific
D.Time-bound
E.Measurable
AnswersC, D, E

Correct component.

Why this answer

SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

Practice this question →
26
Multi-Selecthard

Which THREE of the following are phases of the audit process as defined by ISACA? (Select THREE.)

Select 3 answers
A.Fieldwork
B.Remediation
C.Reporting
D.Planning
E.Execution
AnswersA, C, D

Fieldwork involves testing and evidence gathering.

Why this answer

The audit process phases include planning, fieldwork, reporting, and follow-up.

Practice this question →
27
MCQmedium

Which of the following is a permanent file item in an IS audit working paper?

A.Confirmation letters from vendors
B.Current year's audit program
C.Organizational chart of the IT department
D.List of audit findings for the current year
AnswerC

Organizational charts are typically carried forward as they do not change frequently.

Why this answer

The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts. Current year's audit program is part of the current file.

Practice this question →
28
MCQeasy

Which of the following evidence types involves the auditor independently performing a control procedure to verify its effectiveness?

A.Inspection
B.Observation
C.Inquiry
D.Re-performance
AnswerD

Re-performance is the independent execution of a control.

Why this answer

Re-performance is when the auditor independently executes a control to confirm it operates as designed.

Practice this question →
29
MCQmedium

An IS auditor is testing a control that requires two approvals for purchase orders over $10,000. The auditor selects a sample of 50 purchase orders from the population of 500. Using statistical sampling, the auditor finds 2 deviations. The tolerable deviation rate is 5%. What should the auditor conclude?

A.The control is effective as the sample deviation rate is below the tolerable rate.
B.The auditor should increase the sample size to reduce sampling risk.
C.The control is ineffective because deviations were found.
D.The auditor should conclude that the control is ineffective and report a deficiency.
AnswerA

The sample deviation rate of 4% is below the tolerable rate of 5%, indicating the control is effective.

Why this answer

The sample deviation rate of 4% (2 out of 50) is below the tolerable deviation rate of 5%. Therefore, the control is considered effective based on the sample evidence. The auditor does not need to increase the sample size unless the deviation rate is close to the tolerable rate or other risk factors exist.

In this case, the control can be relied upon as designed.

Exam trap

A common trap is to believe that any deviation indicates control failure, but the conclusion depends on whether the sample deviation rate exceeds the tolerable rate.

Practice this question →
30
MCQhard

An IS auditor is assessing audit risk for a payroll system. The inherent risk is assessed as moderate, control risk as high due to weak segregation of duties, and detection risk is set at low because of extensive substantive testing. What is the impact on overall audit risk?

A.Cannot be determined without more information
B.Low because detection risk is low
C.Very low because all risks are low
D.Moderate to high
AnswerD

High control risk offsets low detection risk.

Why this answer

Audit risk = inherent risk × control risk × detection risk. With high control risk and low detection risk, audit risk is moderate to high.

Practice this question →
31
MCQhard

Which of the following best describes audit risk in the context of an IS audit?

A.Risk that a material misstatement exists.
B.Inherent risk × Control risk × Detection risk
C.Risk that the auditor will issue an incorrect opinion.
D.Risk that controls will not prevent or detect errors.
AnswerC

Correct: This is the standard definition of audit risk.

Why this answer

Audit risk is defined as the risk that the auditor will issue an incorrect opinion (option C). Option B represents the audit risk model (Inherent risk × Control risk × Detection risk), which is a formula for assessing audit risk, not the definition itself. Therefore, C is the best description.

Practice this question →
32
MCQhard

An IS auditor is planning an audit of a decentralized organization with multiple business units. The auditor wants to use a risk-based approach. Which of the following is the MOST appropriate factor to prioritize audit coverage?

A.The geographical location of each business unit.
B.The results of a risk assessment evaluating inherent risk and control effectiveness.
C.The budget allocated to each business unit for IT.
D.The number of employees in each business unit.
AnswerB

Risk assessment directly informs audit coverage.

Why this answer

Risk assessment should consider the inherent risk of each unit, including financial impact, complexity, and past issues, to prioritize high-risk areas.

Practice this question →
33
Multi-Selecthard

An IS auditor is performing a risk assessment for an audit of a cloud service provider. Which THREE factors should be considered when assessing inherent risk? (Select THREE.)

Select 3 answers
A.Complexity of the cloud architecture
B.Effectiveness of monitoring controls
C.Strength of access controls
D.Sensitivity of data stored in the cloud
E.Recent changes to the cloud environment
AnswersA, D, E

Complexity increases inherent risk.

Why this answer

Inherent risk is the risk without controls. Factors include complexity, data sensitivity, and changes in the environment.

Practice this question →
34
Multi-Selectmedium

An IS auditor is planning a risk-based audit of a financial system. Which TWO of the following factors should the auditor consider when assessing inherent risk? (Select two.)

Select 2 answers
A.Complexity of transactions
B.Volume of transactions
C.Auditor's experience with similar systems
D.Results of prior audits
E.Effectiveness of internal controls
AnswersA, B

Complexity of transactions is a direct indicator of inherent risk because intricate processes and calculations are inherently more susceptible to errors or misstatements, even before considering internal controls. For a financial system, highly complex transactions, such as those involving derivatives or multi-currency conversions, present a greater predisposition to material misstatement. An IS auditor must recognise this increased susceptibility when assessing the risk profile of the system.

Why this answer

Inherent risk is the susceptibility to misstatement before considering controls. Complexity of transactions and volume of transactions increase inherent risk. Control effectiveness is part of control risk, and auditor experience relates to detection risk.

Practice this question →
35
Multi-Selecthard

Which THREE of the following are characteristics of a SMART recommendation? (Select three.)

Select 3 answers
A.Measurable
B.General
C.Time-bound
D.Specific
E.Subjective
AnswersA, C, D

Measurable allows tracking of progress.

Why this answer

SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound.

Practice this question →
36
MCQmedium

An IS auditor is performing a compliance audit of a data privacy regulation. Which of the following is the PRIMARY source of audit criteria?

A.Prior audit findings
B.Industry best practices
C.The specific requirements of the regulation
D.The organization's internal policies
AnswerC

Correct; the regulation provides the criteria for compliance.

Why this answer

For a compliance audit, the criteria are the specific requirements of the regulation or law that the organization must adhere to.

Practice this question →
37
Multi-Selectmedium

Which TWO of the following are typically included in the fieldwork phase of an IS audit? (Select two.)

Select 2 answers
A.Defining audit scope
B.Testing controls
C.Developing the audit program
D.Issuing the draft report
E.Performing walkthroughs
AnswersB, E

Testing controls is a fieldwork activity.

Why this answer

Fieldwork involves executing audit procedures; walkthroughs and testing controls are part of fieldwork.

Practice this question →
38
MCQhard

An IS auditor uses statistical sampling to test a population of 10,000 transactions. The auditor discovers 5 errors in the sample of 200. Which of the following conclusions is most appropriate?

A.The population error rate is exactly 2.5%
B.The population has a material weakness
C.The population error rate is 5%
D.The population error rate is likely between 1% and 4% at a given confidence level
AnswerD

Sampling yields a confidence interval around the sample error rate.

Why this answer

Based on sample results, the error rate is 2.5%, which can be projected to the population with a confidence level.

Practice this question →
39
Multi-Selectmedium

An IS auditor is assessing the effectiveness of access controls. Which TWO procedures provide the strongest evidence? (Select two.)

Select 2 answers
A.Re-performance of access provisioning using a test account
B.Inspection of access violation audit logs
C.Inquiry of the security administrator
D.Inspection of user access review documentation
E.Observation of access request processing
AnswersA, B

Re-performance directly tests the control.

Why this answer

Re-performance and inspection of audit logs provide direct evidence of control effectiveness.

Practice this question →
40
MCQmedium

An IS auditor is reviewing the effectiveness of a control that requires dual approval for payments over $10,000. The auditor selects a sample of payments and independently verifies that two approvals were obtained. This audit procedure is:

A.Inquiry
B.Re-performance
C.Observation
D.Inspection
AnswerB

Correct procedure.

Why this answer

Re-performance involves the auditor independently executing the control to verify its effectiveness.

Practice this question →
41
MCQmedium

During an operational audit of an IT department, the auditor finds that system uptime is 99.9% but the department missed two critical project deadlines. Which conclusion is most appropriate?

A.The department has a material weakness in controls
B.The department is efficient but may not be effective
C.The department is operating effectively based on uptime
D.The department should be outsourced
AnswerB

High uptime suggests efficiency, but missed deadlines indicate lack of effectiveness.

Why this answer

Operational audit assesses effectiveness and efficiency; missed deadlines indicate inefficiency or ineffectiveness.

Practice this question →
42
MCQmedium

During an operational audit, the auditor wants to evaluate the efficiency of a data entry process. Which of the following audit procedures would be most appropriate?

A.Performing trend analysis on the number of transactions processed per hour
B.Inspecting system logs to verify user access
C.Observing data entry operators to identify procedural bottlenecks
D.Interviewing the data entry supervisor about error rates
AnswerA

Trend analysis is an analytical procedure that measures efficiency.

Why this answer

Analytical procedures, such as comparing processing times to benchmarks, can identify inefficiencies. Observation may show procedures but not efficiency quantitatively.

Practice this question →
43
MCQhard

An IS auditor is testing the effectiveness of a control that requires dual authorization for all transactions over $10,000. The population consists of 5,000 transactions, of which 250 exceed the threshold. The auditor uses a sample of 50 transactions from the entire population and finds 3 exceptions. What type of sampling method did the auditor use?

A.Judgmental sampling
B.Stratified sampling
C.Random sampling
D.Systematic sampling
AnswerA

The auditor selected a sample from the entire population without a statistical method, which is judgmental.

Why this answer

The auditor selected a sample from the entire population without stratification, and the selection method is not described as random or systematic; however, the description implies a non-statistical judgmental sample. Stratified sampling would require dividing the population into subgroups (e.g., by value).

Practice this question →
44
MCQmedium

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. Which of the following actions should the auditor prioritize?

A.Exclude the ERP system from the audit scope because it is new and not yet stable
B.Include a review of the ERP system in the audit scope due to the high inherent risk
C.Delay the audit until the ERP system has been fully stabilized for six months
D.Focus only on financial reporting controls related to the ERP system
AnswerB

New systems typically have higher risk and warrant audit attention.

Why this answer

A risk-based audit approach requires focusing on high-risk areas. A new ERP system introduces significant risks, so it should be prioritized in the audit scope.

Practice this question →
45
MCQmedium

Which of the following is a key difference between internal and external IS auditors?

A.Internal auditors perform only operational audits.
B.External auditors cannot perform compliance audits.
C.External auditors are required for regulatory compliance.
D.Internal auditors have greater independence.
AnswerC

Correct; external audits are often mandated by regulations.

Why this answer

External auditors are independent third parties, while internal auditors are employees. Independence is a key factor in objectivity and reliability of audit work.

Practice this question →
46
MCQmedium

During a risk-based audit, the IS auditor identifies a control deficiency that could lead to a material misstatement in financial reporting. According to standard classification, this is best described as a:

A.Observation
B.Deficiency
C.Finding
D.Material weakness
AnswerD

A material weakness is a deficiency that could result in a material misstatement.

Why this answer

A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement will not be prevented or detected.

Practice this question →
47
MCQeasy

Which of the following audit types is MOST likely to be performed by an organization's own employees?

A.External audit
B.IS audit
C.Internal audit
D.Compliance audit
AnswerC

Internal audits are conducted by the organization's own staff.

Why this answer

Internal audits are conducted by employees of the organization, providing deep knowledge but raising independence concerns.

Practice this question →
48
MCQmedium

An auditor is selecting a sample of purchase orders for testing. The auditor decides to select every 50th purchase order from a list. This is an example of:

A.Judgmental sampling
B.Random sampling
C.Systematic sampling
D.Stratified sampling
AnswerC

Correct definition.

Why this answer

Systematic sampling selects items at a fixed interval (every nth item).

Practice this question →
49
Multi-Selectmedium

Which TWO of the following are types of analytical procedures used in an IS audit? (Select two.)

Select 2 answers
A.Ratio analysis
B.Observation
C.Re-performance
D.Trend analysis
E.Inquiry
AnswersA, D

Correct analytical procedure.

Why this answer

Ratio analysis and trend analysis are common analytical procedures.

Practice this question →
50
MCQhard

Which of the following best describes the primary advantage of using statistical sampling over non-statistical sampling in an IS audit?

A.It is more effective for detecting fraud than non-statistical sampling.
B.It ensures that all items in the population are tested.
C.It provides a basis for quantifying sampling risk and projecting results to the population.
D.It requires less auditor judgment and is easier to apply.
AnswerC

Statistical sampling allows the auditor to measure and control sampling risk and make statistical inferences.

Why this answer

Statistical sampling allows the auditor to quantify sampling risk and project results to the population with a measurable confidence level, unlike non-statistical sampling.

Practice this question →
51
MCQhard

An IS auditor is assessing the risk of material misstatement in a financial system. The auditor determines that inherent risk is high, control risk is moderate, and detection risk is low. What is the overall audit risk?

A.Low
B.Moderate
C.High
D.Cannot be determined
AnswerA

Correct. Low audit risk results from the combination of high inherent risk, moderate control risk, and low detection risk.

Why this answer

Audit risk is determined by inherent risk, control risk, and detection risk. The standard audit risk model is: Audit Risk = Inherent Risk × Control Risk × Detection Risk. With inherent risk high, control risk moderate, and detection risk low, the product is low (e.g., High × Moderate × Low = Low).

This indicates a low overall audit risk because the auditor plans to perform sufficient substantive procedures to compensate for the high inherent and moderate control risks.

Practice this question →
52
MCQeasy

Which of the following is an example of a compliance audit?

A.Evaluating whether IT controls meet SOX requirements
B.Assessing the performance of a new system
C.Reviewing the efficiency of a production line
D.Analyzing financial statement ratios
AnswerA

SOX is a regulation; compliance audit checks adherence.

Why this answer

Compliance audits verify adherence to laws, regulations, and policies.

Practice this question →
53
MCQmedium

An external auditor is conducting a compliance audit for a company subject to SOX. Which standard is most relevant for this engagement?

A.IIA Standards
B.ISACA IT Audit Standards
C.GAAS
D.COBIT
AnswerC

Correct for external audits.

Why this answer

GAAS (Generally Accepted Auditing Standards) are relevant for external audits, including compliance audits.

Practice this question →
54
MCQmedium

An IS auditor is performing a walkthrough of a purchase-to-pay process. Which of the following is the auditor most likely trying to achieve?

A.Understand the process and identify controls
B.Gather evidence for audit findings
C.Test the effectiveness of controls
D.Verify the accuracy of transaction data
AnswerA

Walkthroughs provide an overview of the process and control points.

Why this answer

A walkthrough helps the auditor understand the process flow and identify controls in place.

Practice this question →
55
MCQmedium

An IS auditor is assessing the risk of a new financial application. The auditor determines that inherent risk is high due to complex transactions, but control risk is low because of strong automated controls. If detection risk is set at 5%, what is the audit risk?

A.8.0%
B.0.8%
C.1.0%
D.5.0%
AnswerB

Audit risk = Inherent risk × Control risk × Detection risk. With inherent risk 80%, control risk 20%, detection risk 5%: 0.8 × 0.2 × 0.05 = 0.008 = 0.8%.

Why this answer

Audit risk = Inherent risk × Control risk × Detection risk. Assuming inherent risk = 80%, control risk = 20%, detection risk = 5%, audit risk = 0.8 × 0.2 × 0.05 = 0.008 = 0.8%.

Practice this question →
56
MCQmedium

Which of the following is the PRIMARY purpose of performing a walkthrough during the audit planning phase?

A.To test the operating effectiveness of controls
B.To collect evidence of control failures
C.To identify process owners and key personnel
D.To gain an understanding of the process and identify control points
AnswerD

Correct; walkthroughs are used to understand process flow and controls.

Why this answer

A walkthrough helps the auditor understand the flow of transactions and identify control points, which aids in assessing control design and identifying risks.

Practice this question →
57
MCQhard

During the fieldwork phase, an IS auditor discovers that a control is not operating as designed. The auditor reperforms the control and finds that it is effective. Which of the following conclusions is MOST appropriate?

A.The control is operating effectively based on the re-performance.
B.The control design is adequate but implementation is weak.
C.The re-performance is not sufficient; additional testing is required.
D.The control is not operating effectively because the design was not followed.
AnswerA

Correct; the re-performance provides direct evidence of effectiveness.

Why this answer

If the auditor's independent re-performance shows the control is effective, the control is operating effectively, despite the initial indication of a deviation.

Practice this question →
58
MCQmedium

An IS auditor is planning an audit of a financial application. The auditor wants to ensure that audit effort is focused on areas with the highest risk. Which approach should the auditor adopt?

A.Substantive approach
B.Control self-assessment approach
C.Compliance-based approach
D.Risk-based audit approach
AnswerD

Correctly focuses on high-risk areas.

Why this answer

A risk-based audit approach prioritizes high-risk areas for more intensive testing, aligning with ISACA standards.

Practice this question →
59
Multi-Selectmedium

Which TWO of the following are types of statistical sampling methods? (Select TWO.)

Select 2 answers
A.Block sampling
B.Stratified sampling
C.Systematic sampling
D.Haphazard sampling
E.Judgmental sampling
AnswersB, C

Stratified sampling divides the population into subgroups.

Why this answer

Stratified sampling and systematic sampling are both statistical methods that use random selection.

Practice this question →
60
MCQmedium

Which of the following is the most reliable form of audit evidence?

A.Re-performance of a control by the auditor
B.Inquiry of management about a control
C.Observation of a control being performed
D.Inspection of signed approval forms
AnswerA

Re-performance provides direct, objective evidence.

Why this answer

Re-performance is the most reliable because the auditor independently performs the control, obtaining direct evidence. Observation is less reliable because the auditor may influence behavior.

Practice this question →
61
MCQeasy

During which phase of the audit process does the auditor perform procedures such as inquiry, observation, and inspection?

A.Follow-up
B.Fieldwork
C.Reporting
D.Planning
AnswerB

Fieldwork includes executing audit procedures like inquiry, observation, and inspection.

Why this answer

Fieldwork is the phase where audit procedures are executed to gather evidence.

Practice this question →
62
MCQmedium

During an audit, the IS auditor identifies that a system access control deficiency could lead to unauthorized modification of financial data. The deficiency does not have a compensating control. How should the auditor classify this finding?

A.Material weakness
B.Deficiency
C.Observation
D.Finding
AnswerA

A material weakness is a deficiency that could result in a material misstatement.

Why this answer

A deficiency that could result in a material misstatement is classified as a material weakness.

Practice this question →
63
MCQmedium

Which type of audit evidence involves the auditor independently performing a control procedure to verify its effectiveness?

A.Inspection
B.Observation
C.Re-performance
D.Inquiry
AnswerC

Re-performance is the auditor doing the control themselves.

Why this answer

Re-performance is when the auditor independently executes a control to confirm it operates as intended.

Practice this question →
64
MCQhard

An IS auditor is reviewing the audit documentation from a prior year and finds that a material weakness was reported but not remediated. According to ISACA standards, which audit phase should address this?

A.Reporting
B.Fieldwork
C.Planning
D.Follow-up
AnswerD

Follow-up ensures that corrective actions have been implemented effectively.

Why this answer

Follow-up is the phase dedicated to verifying that management has implemented corrective actions for previous findings.

Practice this question →
65
MCQmedium

During the follow-up phase of an audit, the auditor discovers that a previous finding has not been remediated. What is the auditor's BEST course of action?

A.Perform additional testing to confirm the finding
B.Report the lack of remediation to senior management
C.Ignore the finding since it was previously reported
D.Close the finding as accepted risk
AnswerB

Escalation ensures accountability and corrective action.

Why this answer

If remediation has not occurred, the auditor should escalate the issue to management to ensure action is taken.

Practice this question →
66
Multi-Selecteasy

Which TWO of the following are phases of the audit process? (Select two.)

Select 2 answers
A.Budgeting
B.Planning
C.Risk assessment
D.Training
E.Reporting
AnswersB, E

Correct phase.

Why this answer

The audit process includes planning, fieldwork, reporting, and follow-up.

Practice this question →
67
MCQmedium

Which of the following is a key difference between internal and external auditors?

A.Internal auditors are required for regulatory compliance
B.Internal auditors focus only on financial controls
C.External auditors have deeper organizational knowledge
D.External auditors are more independent than internal auditors
AnswerD

External auditors are independent of the organization.

Why this answer

External auditors are independent third parties, while internal auditors are employees of the organization.

Practice this question →
68
MCQmedium

During the planning phase of an IS audit, the auditor identifies that the organization has recently implemented a new ERP system. The audit team has limited experience with this ERP. Which of the following is the BEST course of action?

A.Limit the audit scope to exclude the new ERP system.
B.Proceed with the audit using existing staff and hope for the best.
C.Postpone the audit until the team gains sufficient experience.
D.Engage an external specialist with ERP expertise to supplement the audit team.
AnswerD

Using a specialist ensures adequate coverage of the new system.

Why this answer

Incorporating an external specialist with ERP expertise ensures the audit is conducted effectively despite the team's lack of experience.

Practice this question →
69
MCQeasy

Which document is typically included in the permanent file of audit documentation?

A.Organizational chart
B.Management representation letter
C.Current year audit program
D.Working papers for testing
AnswerA

Organizational charts are carryforward items.

Why this answer

The permanent file contains information that is relevant for multiple audits, such as organizational charts and key contracts.

Practice this question →
70
MCQhard

An IS auditor is evaluating the design of controls over a new financial system. Which of the following is the BEST approach to assess control design?

A.Use analytical procedures to identify anomalies
B.Review system documentation and conduct walkthroughs
C.Perform detailed testing of transactions
D.Interview management and review policies
AnswerB

Correct; documentation and walkthroughs are primary methods for assessing design.

Why this answer

Reviewing system documentation and conducting walkthroughs allows the auditor to understand the intended design and compare it to actual implementation.

Practice this question →
71
Multi-Selectmedium

Which TWO of the following are examples of analytical procedures used as audit evidence? (Select two.)

Select 2 answers
A.Ratio analysis
B.Inquiry of management
C.Inspection of documents
D.Trend analysis
E.Observation of process
AnswersA, D

Ratio analysis is an analytical procedure.

Why this answer

Analytical procedures include ratio analysis and trend analysis; inquiry and inspection are other types.

Practice this question →
72
MCQmedium

Which of the following is a characteristic of non-statistical (judgmental) sampling?

A.Every item has an equal chance of selection
B.The auditor uses professional judgment to select sample items
C.The sample size is determined using statistical formulas
D.The sample results can be projected to the population with known confidence
AnswerB

Judgmental sampling is based on auditor expertise.

Why this answer

Non-statistical sampling relies on the auditor's judgment and does not use probability theory.

Practice this question →
73
MCQeasy

Which of the following is the PRIMARY purpose of audit working papers?

A.To provide a permanent record of the organization's financial transactions.
B.To support the auditor's conclusions and provide evidence of the work performed.
C.To serve as a basis for the audit fee calculation.
D.To replace the need for management's representation letter.
AnswerB

Working papers serve as the primary evidence of the audit.

Why this answer

Working papers document the audit procedures performed, evidence obtained, and conclusions reached, supporting the audit opinion.

Practice this question →
74
MCQhard

An IS auditor is preparing working papers. Which of the following items should be included in the permanent file rather than the current file?

A.Audit programme for the current year
B.Testing results from current audit
C.Management responses to current findings
D.Organization chart
AnswerD

Organization chart is a carryforward item.

Why this answer

The permanent file contains carryforward items like organizational charts and key contracts.

Practice this question →
75
MCQhard

During an audit, the auditor uses a sampling method where the population is divided into subgroups, and samples are selected from each subgroup. This method is known as:

A.Systematic sampling
B.Judgmental sampling
C.Random sampling
D.Stratified sampling
AnswerD

Correct definition.

Why this answer

Stratified sampling divides the population into subgroups (strata) and samples from each.

Practice this question →
Page 1 of 2 · 103 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Information System Auditing Process questions.

Start 20-question session