CCNA Cisa Audit Process Questions

Engaging an external specialist supplies the ERP technical competence the audit team lacks, letting them assess controls and risks accurately. This satisfies the constraint of limited in-house ERP experience while preserving audit quality and objectivity.

The permanent file holds enduring reference material relevant across multiple audits, such as the organisational chart, which documents structure and reporting lines. It is not engagement-specific evidence, so it stays on file rather than being refreshed each audit.

Reviewing documentation establishes the intended control design, while walkthroughs trace a transaction end-to-end to confirm the control operates as documented. Together they test design adequacy before any operating-effectiveness testing, which is the objective stated in the stem.

Ratio analysis is an analytical procedure: it compares financial or operational relationships to identify unusual variances or trends warranting investigation. This qualifies as substantive audit evidence derived from analysis rather than direct testing of transactions or controls.

Judgmental sampling relies on the auditor's professional judgement, experience and knowledge of the population to select items, rather than probabilistic methods. This satisfies the stem's requirement for a non-statistical characteristic, since selection is deliberate and subjective, with no random selection or calculable sampling risk attached.

An organisation chart changes infrequently and provides ongoing context about structure, reporting lines and responsibilities, so it belongs in the permanent file. Current files hold items specific to the audit period, such as working papers and testing results.

Stratified sampling divides the population into distinct subgroups (strata) and draws samples from each, directly matching the stem's description. Unlike simple random or systematic sampling, it guarantees representation across every subgroup, which suits audit populations with heterogeneous characteristics where each stratum warrants coverage.

The auditor should first validate the design and operating effectiveness of the implemented control, since management's assertion alone is insufficient evidence. Only after testing can the auditor assess whether residual risk has actually been reduced to an acceptable level. Updating the risk register is a management responsibility, and reporting to the audit committee is premature without verification.

External auditors sit outside the organisation's reporting line, so they owe no employment allegiance to management and face no promotion or remuneration pressure from the audited entity. This structural separation from the chain of command directly satisfies the stem's independence constraint, unlike internal auditors who remain employees subject to management authority.

A critical exploitable vulnerability in a web-facing application represents an immediate risk of data compromise. The auditor should recommend urgent remediation or mitigation, such as applying a patch, input validation, or a web application firewall rule, and then validate that the fix works. Addressing the exposure takes precedence over documentation and longer-term process improvements.

Re-performance involves the auditor independently executing the control procedure and comparing the result with the original, producing evidence generated directly by the auditor rather than the auditee. This self-generated evidence satisfies the stem's demand for the highest assurance, outranking inspection, observation and inquiry, which rely on entity personnel or documentation.

A significant unexplained variance requires investigation before any conclusion is drawn, since analytical procedures identify anomalies rather than their causes. The auditor must obtain corroborating evidence, such as management explanations, supporting documentation or transaction testing, to determine whether the increase reflects error, fraud or legitimate business change.

Statistical attribute sampling quantifies the exception rate against a defined confidence level and tolerable deviation rate, letting the auditor conclude on the 5,000-item population with measurable precision. Judgemental or block methods cannot support the stated 95% confidence and 2% tolerable error.

The auditor's responsibility is to assess whether the implemented control reduces risk to an acceptable level, regardless of whether it matches the original recommendation. If the compensating control adequately mitigates the risk and residual risk falls within the risk appetite, the finding can be closed. This reflects the principle that management owns risk response while the auditor provides objective assurance on the outcome.

Random sampling gives every transaction in the 1,000-item population an equal, non-zero chance of selection, which the random number generator enforces. This satisfies the stem's requirement for a statistically valid, unbiased sample, unlike haphazard or judgmental methods, and supports extrapolating the 50-transaction results to the full population.

The planning phase establishes the audit's foundation by assessing inherent and control risks, then using that risk assessment to define scope, objectives, criteria and resource allocation, ensuring fieldwork concentrates effort on the areas of greatest significance to the organisation.

The most persuasive evidence about whether backups can actually be restored is a restoration test. Performing or observing a test allows the auditor to verify that the backup media are readable, that the recovery procedures work, and that recovery time objectives are realistic. This direct evidence supports a reliable conclusion about the control's operating effectiveness, which is exactly what the auditor needs before deciding whether a finding is warranted.

A walkthrough is itself the audit procedure being executed; the auditor traces transactions through the accounts payable process to confirm controls operate as described. This satisfies the stem directly, as the procedure's name matches the activity performed.

Testing the compensating controls establishes whether they actually reduce the risk arising from the missing control, which is the evidence needed before concluding on control adequacy. Walkthroughs alone only confirm design; substantive testing of the compensating control's operating effectiveness satisfies the auditor's obligation to assess residual risk.

The assessed level of control risk is low because controls are strong and have been tested. Under the audit risk model, lower control risk allows the auditor to place greater reliance on controls and reduce the extent of substantive procedures. This keeps detection risk at a level that holds overall audit risk within acceptable bounds while avoiding unnecessary testing. High inherent risk is already reflected in the assessment and is managed through this combined approach.

A risk-based approach directs scarce audit resources toward the areas of greatest exposure, which suits a small organisation where limited IT staff cannot support exhaustive testing. Comprehensive or cyclical coverage would over-extend the available audit capacity.

Fieldwork is the audit phase where the auditor gathers evidence, performs walkthroughs and tests controls to evaluate their design and operating effectiveness. This satisfies the stem directly, as control testing occurs after planning and before reporting.

Ratio analysis compares financial and operational data across periods and against benchmarks, which is the defining characteristic of analytical procedures. It evaluates relationships and trends rather than testing individual transactions or controls, satisfying the audit objective of identifying unusual variances warranting further investigation.

Management experience and turnover affect inherent risk because unstable or inexperienced leadership increases the chance of poor decisions, inadequate oversight, and control lapses. These are environmental factors that exist independently of specific controls. ISACA guidance includes management competence and stability among inherent risk considerations, making this a valid factor when prioritizing audit engagements in the annual plan.

Risk-based auditing directs limited resources toward exposures with the greatest likelihood and impact, weighted by how weakly existing controls mitigate them. Prioritising high-risk, low-control-effectiveness areas satisfies the stem's requirement, since coverage then targets residual risk rather than spreading effort uniformly.

The lack of reconciliation between the visitor log and the badge system means unauthorized or unescorted access could go undetected. The control objective is to ensure all physical entries are authorized and monitored. Without reconciliation, the log and badge records cannot be relied upon to detect discrepancies, so the control is not operating effectively.

Limited IT staff means fewer preventive controls such as segregation of duties, so the auditor emphasises detective and compensating controls to obtain assurance. This approach acknowledges the resource constraint while still addressing risk through monitoring and reconciliation.

Internal auditors being employees creates a self-review threat, since they report to management and may audit areas they influence. This directly satisfies the stem's focus on a key difference: external auditors are engaged independently, whereas internal audit's employment relationship can impair objectivity and independence.

Observation involves the auditor watching a process or control being performed, such as witnessing a backup or physical access procedure. ISACA recognises observation alongside inspection, inquiry, re-performance and analytics as a distinct audit evidence type.

Measurable means the recommendation states quantifiable criteria or a verifiable outcome, enabling the auditor to objectively assess whether management's corrective action has been implemented. This satisfies the SMART requirement that progress and completion be demonstrable rather than subjective.

Operational audits examine whether processes achieve their objectives efficiently and effectively, covering economy, efficiency and effectiveness of resource use. Unlike financial audits, which verify monetary accuracy, or compliance audits, which test adherence to rules, this type directly addresses the stem's efficiency and effectiveness focus.

Follow-up must determine whether the corrective action actually remedied the reported condition, not merely that something was done. Assessing effectiveness tests the outcome against the original finding, satisfying the follow-up objective of confirming that risk has been genuinely reduced.

Real-time posting without contemporaneous controls means errors or unauthorized transactions can affect customer balances before the daily reconciliation identifies them. The reconciliation confirms the batch total but does not prevent incorrect individual postings, so the exposure window lasts until the daily check, creating potential financial loss and customer impact.

The audit charter is the formal document that defines the internal audit function's purpose, authority, and responsibility. ISACA standards require that the charter establish the function's position within the organization and grant it access to records, personnel, and physical properties. Approval by the board or audit committee gives the function its mandate, making this the primary purpose of the charter.

The administrator's ability to modify the script that generates the report undermines the reliability of the evidence because the report could be manipulated to exclude exceptions. This compromises the integrity of the evidence, making it less reliable. The auditor must consider whether the script is controlled and whether its logic is independently validated before relying on the report.

Internal audit is performed by employees of the same organisation, so the auditor reports through internal management and may lack freedom from the activities being reviewed. That structural reporting relationship creates the independence concern the stem describes, unlike external audit or third-party assessments conducted by parties outside the entity.

ISACA standards require the auditor to obtain sufficient, competent evidence; where the team lacks the technical skill to evaluate a system, that competence gap must be closed by engaging a subject matter expert. This preserves the audit's objectivity and evidentiary adequacy rather than issuing an uninformed opinion.

Discussing findings with the auditee before finalizing the report confirms that the facts, conditions, and evidence are accurate and complete, and it gives management an opportunity to correct misunderstandings or provide additional context. This validation step strengthens the reliability of the report and reduces the risk of factual errors. It is a fundamental quality control activity in the audit process and the primary reason for the discussion.

When management implements a compensating control in lieu of the recommended control, the auditor must assess whether the alternative control adequately addresses the original risk. This involves testing the design and operating effectiveness of the compensating control to ensure it reduces the risk to an acceptable level. Only after such evaluation can the auditor conclude on the status of the finding.

Inspecting change tickets produces documentary evidence and directly tests the control: the audit programme asks whether approvals preceded implementation. By comparing the approval timestamp on each ticket with the deployment timestamp in the same record, the auditor can detect changes deployed before authorization. This is the most persuasive technique available here because it is independent of verbal assertions and covers the actual population of changes.

Detection risk is the component the auditor directly controls through the nature, timing and extent of substantive testing. With inherent risk high and control risk low, the auditor adjusts testing to keep detection risk at a level that holds overall audit risk within acceptable bounds.

Follow-up confirms management actually remediated the reported findings, testing whether agreed corrective actions were implemented and are operating effectively. This closes the loop after the final report, satisfying the stem's requirement to determine that risks previously identified have genuinely been addressed rather than merely promised.

Evidence must bear a logical relationship to the control objective. For database access controls, configuration extracts, access listings, and approval records are relevant because they speak directly to who can access the database and whether access was authorized, whereas unrelated material cannot support a conclusion no matter how voluminous.

Analytical procedures evaluate financial information through plausible relationships among data. Comparing current-year expenses against prior-year figures is a substantive analytical comparison that highlights unexpected fluctuations or trends, unlike inquiry, observation or inspection, which are tests of controls or detail.

ISACA standards require the final report to document findings, their risk implications, recommendations, and management's agreed action plans with target dates. Including all three elements ensures the report is complete, actionable, and supports follow-up of remediation.