28 of 103 questions · Page 2/2 · Information System Auditing Process · Answers revealed
Which of the following is the PRIMARY reason an external audit is considered more independent than an internal audit?
Third-party status enhances independence.
Why this answer
External auditors are third-party and not employees, reducing bias and enhancing independence.
Which of the following types of audit evidence provides the highest level of assurance?
Re-performance independently validates control effectiveness.
Why this answer
Re-performance provides direct evidence that a control is operating effectively.
During the fieldwork phase, an IS auditor uses analytical procedures to compare current year IT expenses to prior year. A significant increase is noted. What should the auditor do next?
The auditor should gather evidence to explain the variance.
Why this answer
Analytical procedures identify anomalies; the auditor should investigate the cause before concluding.
An IS auditor is selecting audit procedures to test controls over user access. Which of the following is an example of a re-performance procedure?
Independently creating a test user account and verifying its access rights constitutes a re-performance procedure because the auditor executes the control from scratch—provisioning the account and then testing the resultant permissions—rather than merely observing or inspecting evidence of the original process. This directly satisfies the stem’s requirement for a procedure that repeats the control activity to confirm its effectiveness, as opposed to inquiry or document review.
Why this answer
Re-performance involves the auditor independently performing a control to verify its effectiveness. For access controls, independently adding a test user and verifying access rights is a re-performance.
An IS auditor is testing the effectiveness of a control that involves a manual review of exception reports. The population of exceptions is 5,000 items. The auditor wants to achieve a 95% confidence level with a tolerable error rate of 2%. Which sampling method is MOST appropriate?
Correct; attribute sampling is used to estimate the proportion of items with a certain characteristic and provides statistical confidence.
Why this answer
Statistical sampling (attribute sampling) is appropriate when the auditor wants to draw a conclusion about the population's error rate with a specified confidence level.
An IS auditor selects a sample of 50 transactions from a population of 1,000 using a random number generator. This is an example of which sampling method?
Random sampling uses a random selection method.
Why this answer
Statistical random sampling gives every item an equal probability of selection.
What is the primary purpose of the planning phase in an IS audit?
Planning includes risk assessment and scope definition.
Why this answer
Planning ensures the audit is focused on high-risk areas and resources are allocated appropriately.
An IS auditor is performing a walkthrough of the accounts payable process. Which audit procedure is the auditor primarily executing?
Correctly identifies the procedure.
Why this answer
A walkthrough involves tracing a transaction from initiation to completion, often combining inquiry, observation, and inspection.
An IS auditor is evaluating the design of controls over a critical financial application. The auditor performs a walkthrough and identifies that a control is missing but management has compensating controls. Which of the following is the auditor's BEST next step?
Compensating controls can reduce the severity of the deficiency.
Why this answer
Assessing the effectiveness of compensating controls is appropriate to determine if the control deficiency is mitigated.
An IS auditor is planning an audit of a small organization with limited IT staff. Which approach is most appropriate?
Risk-based auditing is effective and efficient.
Why this answer
A risk-based approach prioritizes areas with highest risk, efficient for limited resources.
During which phase of the IS audit process does the auditor perform walkthroughs and test controls?
Fieldwork is the phase where audit procedures such as walkthroughs and testing are performed.
Why this answer
Walkthroughs and control testing are performed during fieldwork, where the auditor executes planned audit procedures.
During an operational audit, the auditor uses ratio analysis to compare current year expenses to prior years and industry benchmarks. This is an example of which type of audit evidence?
Analytical procedures include ratio and trend analysis.
Why this answer
Analytical procedures involve evaluations of financial information through analysis of plausible relationships.
In a risk-based audit approach, which of the following BEST describes how an IS auditor should prioritize audit coverage?
High risk and weak controls warrant more attention.
Why this answer
A risk-based approach focuses on areas with higher inherent risk and weaker controls to maximize effectiveness.
An IS auditor is planning an audit of a small organization with limited IT staff. Which of the following is a key consideration for the audit approach?
Correct; when segregation is limited, detective controls become more important.
Why this answer
In small organizations, segregation of duties may be limited, so the auditor should place greater reliance on detective and compensating controls.
Which of the following is a key difference between an internal audit and an external audit?
Independence is a key concern for internal auditors.
Why this answer
Internal auditors are employees of the organization, which may create independence concerns, while external auditors are independent third parties.
Which TWO of the following are types of audit evidence recognized in IS audit practice?
Observing a process being performed is direct evidence.
Why this answer
Observation and re-performance are both types of evidence; inquiry is also a type, but the question asks for TWO. The correct pair is observation and re-performance.
Which THREE of the following are characteristics of SMART recommendations in an audit report? (Select three.)
Progress should be quantifiable.
Why this answer
SMART stands for Specific, Measurable, Achievable, Relevant, Time-bound. Vague and rigid are not desirable.
Which type of audit is primarily concerned with evaluating the efficiency and effectiveness of operations?
Correct type.
Why this answer
An operational audit focuses on efficiency and effectiveness of operations.
In the audit follow-up phase, which TWO actions are essential? (Select two.)
Follow-up evaluates whether actions resolved the finding.
Why this answer
Follow-up includes verifying that management has implemented corrective actions and assessing their effectiveness.
Which of the following audit types is most likely to be conducted by an employee of the organization being audited, potentially raising independence concerns?
Internal audits are conducted by employees of the organization.
Why this answer
Internal audits are performed by employees of the organization, which can create independence issues. External audits are conducted by third parties.
During an audit, the IS auditor identifies that the audit team lacks the technical expertise to evaluate a specific system. According to ISACA standards, the auditor should:
Correct; engaging a specialist is appropriate.
Why this answer
If the audit team lacks necessary expertise, the auditor should engage a specialist or subject matter expert to ensure audit quality.
Which THREE factors should an IS auditor consider when determining the sample size for a compliance test? (Select three.)
Lower tolerable error rate needs larger sample.
Why this answer
Sample size is influenced by desired confidence, tolerable error rate, and expected error rate.
An IS auditor is planning an audit of a financial system. The auditor identifies that the inherent risk is high due to the complexity of transactions, but control risk is low because of strong automated controls. Which component of audit risk will be MOST affected by the auditor's testing strategy?
Detection risk is managed by the extent of testing.
Why this answer
Detection risk is the risk that audit procedures fail to detect material misstatements. With low control risk, the auditor may rely on controls and reduce substantive testing, affecting detection risk.
After issuing the final audit report, the IS auditor should perform follow-up procedures. What is the PRIMARY purpose of follow-up?
Correct; the main purpose is to verify remediation.
Why this answer
Follow-up ensures that management has taken corrective actions to address the findings and that the risks have been mitigated.
An IS auditor is assessing the effectiveness of controls over a critical financial system. Which TWO types of evidence provide the highest level of assurance? (Select TWO.)
Re-performance provides direct evidence of control effectiveness.
Why this answer
Re-performance and observation provide direct evidence; re-performance shows the control works, and observation provides witness of execution.
An IS auditor is using analytical procedures during the planning phase. Which of the following is an example of an analytical procedure?
Correct; this is a trend analysis, a type of analytical procedure.
Why this answer
Analytical procedures involve comparisons of data to expectations, such as comparing current-year data to prior-year data to identify unusual fluctuations.
According to ISACA audit standards, which TWO of the following are phases of the audit process? (Select two.)
Reporting is a distinct phase.
Why this answer
The standard audit process phases are planning, fieldwork, reporting, and follow-up. Risk assessment is part of planning, and testing is part of fieldwork.
An IS auditor is preparing the audit report. According to ISACA standards, which of the following should be included in the final audit report?
Correct; this is the standard content of an audit report.
Why this answer
The final audit report should include findings, recommendations, and management's action plans to provide a complete picture and enable follow-up.
Ready to test yourself?
Try a timed practice session using only Information System Auditing Process questions.