This is sampling example of compliance, as it states whether controls are functional as per the policy. This will include taking samples of new user account creation forms and match it to ensure process is being followed. Variable sampling is used to determine numerical value. Substantive sampling tests the integrity of process such as credit / debit values, balances on financial statements. Stop or go sampling technique prohibits excessive sampling of an attribute.
The Stop and go statistical sampling technique in a scenario where it is believed or perceived that relatively few errors will be exposed, so there is point in wasting over sampling of an attribute.
“Use of statistical sample for tape library inventory” is an example of ____ type of sampling technique.
Stop or go
This is an example of substantive sampling which confirms the integrity of a process. This test will determine whether tape library records are stated in a correct manner.
What is the major benefit of risk based audit planning approach?
Planning scheduling in advance over months
Staff exposure to varied technologies
Resources allocation to areas of top concern
Budget requirements are met by audit staff
The objective of risk based audit approach is focus on areas where risk is high. Various scheduling methods are used to prepare audit schedules and it does not come under risk based approach. It also does not relate to budget requirements met by staff and number of audits performed in a given year.
Examples of substantive sampling technique include:
Review of password history reports
Approval for configuration parameters changes
Tape library inventory
Verifying list of exception reports
Tape library inventory is an example of substantive sampling as it confirms the integrity of a process associated with determining whether tape records are stated in a correct manner. All others are example of compliance sampling as they determine whether the process in practice is inline with the established policies and procedures.
The characteristic of an audit charter is:
Is dynamic is nature and keeps changing frequently as the technology changes
It contains the objectives of audit, maintenance and review of internal records by delegated authority
Detailed audit procedures
Overall scope, ownership and responsibility of audit function
Audit charter states management objectives, scope, ownership and delegation of responsibility of audit function. It should not change frequently and approved by higher management. Also it does not contain detail audit procedures.
The auditor actions and decisions impact the ___ type of risk in a major manner.
Auditor selection / decisions during the audit process have direct impact on detection risks, such as enough number of samples not taken into consideration etc. Company actions manage the control risks and business and inherent risks are also not impacted by auditor.
Particular threat to overall business risk can be articulated in terms of:
Likelihood and magnitude of impact , where threat successfully exploited a vulnerability
Magnitude of impact, where source of threat successfully exploited a vulnerability
Probability of a given source of threat exploiting a vulnerability
Risk assessment team group decision
The choice A addresses both likelihood and magnitude of impact and measures risk to an asset in best manner. Choice B doesn’t consider the magnitude of possible damage to an asset. Choice C don’t consider the possibility of damage due to source threat exploiting a vulnerability and choice D is an arbitrary method of determining risk and it is not a scientific risk management approach.
Risk management approach over baseline approach in information security management gives a major advantage in terms of:
Overprotection of information assets
Base level protection to all assets irrespective of asset value
Adequate protection applied to all information assets
Equal level of protection for all information assets
Baseline approach applies a standard set of protection to all information assets whereas the risk management based approach determines the level of protection to be applied depending on a given level of risk. This saves the costs incurred on overprotection of an information asset. In baseline approach equal level of protection is applied for all information assets irrespective of asset value so as a result some assets could be under protective and some could be overprotective.
Which testing method is most effective when doing the compliance testing?
Stratified mean per unit
Choice A is appropriate in this scenario. As attribute sampling model estimate the rate of occurrence of a specific quality in a population to confirm whether quality is present in compliance testing. The other means of sampling are used in substantive testing where details and quantity testing is done.
Why email is considered a useful source of evidence in litigation in IS audit process?
Wide use of email systems in enterprises as medium of communication
Access control mechanisms to establish email communication accountability
Backup and archiving of information flowing through email systems
Data classification guidelines dictating information flow via email systems
Option C is most appropriate as archived/ backed up email files, may contain documents which have been deleted and could be recovered. Access controls only establish accountability but don’t give evidence of the email. Data classification standardizes what to be communicated by email but don’t provide information needed for litigation process.
A post implementation review of an application is scheduled by IS auditor. What could be the possible situation which can hamper the independent assessment of IS auditor.
Involved in the development of specific application and implemented specific functionality / control
Integrated an embedded audit module in the application for auditing purpose
Was member of application system project team but not involved at operational level
Given advice on considering best practices while system was in development stage
Choice A is most appropriate in this scenario because the auditor independence is impaired in case he was involved actively during the development, acquisition and implementation of the new application. Choice B and C don’t hamper auditor independence. And Choice D is not correct as auditor independence is not hampered by given advice on best known practices.
What is the benefit of continuous audit approach:
Collection of evidence is not required on system reliability during the processing stage
Review and follow up on all information collected
Improvement in overall security in time sharing environment where large number of transactions processed
No dependency on complexity of organization’s systems
Choice C is most appropriate w.r.t to continuous audit process major benefit as overall security is improved in time sharing environments where large number of transactions is processed but leaving insufficient trail of papers. Choice A is not correct as auditor need to collect evidence while processing is ON. Choice B is also not correct in this case as auditor does review and follows up on errors and material deficiency. Choice D is also incorrect as complexity of organization systems determines the use of continuous audit process technique.
The objective of enabling audit trail is:
Better response time for users
Institute Accountability of processed transactions
Improving operational efficiency of systems
Better tracking of transactions to give useful information to auditors
Choice B is most appropriate in this scenario as accountability and responsibility can be established for processed transactions and tracing could be done end to end. Enabling audit trail don’t improve user experience as it might involve additional processing which may impact user response time in other way. Choice D could also be considered valid but it is not the main reason for the purpose of enabling audit trails.
In a risk based audit strategy, risk assessment is done by IS auditor to ensure:
Risk mitigation controls are in place
Threats and vulnerabilities are identified
Risks related to audit are taken into consideration
Gap analysis is done as per the need
Choice B is most appropriate in this scenario. Identification of threats and vulnerabilities is crucial in determining the scope of audit. Effect of an audit would be to develop controls to mitigate risks. Audit risks are not relevant to risk analysis of environment. Gap analysis compares the actual state to expected or desired state. A gap could be result of a risk not being correctly addressed or missed out.
In order to achieve best value to organization in terms of audit resources we should :
Do audit scheduling and measure the time spent on audits
Training of audit staff on latest audit technologies
Chalk out detailed plan based on risk assessment
Progress monitoring of audits and have cost control measures in place
Choice C is most appropriate in this scenario. This will deliver value to organization in terms of dedicating resources on higher risk areas. Choice A, B and D will improve the staff productivity only.
An IS audit charter includes:
Plan for IS audit engagements
Scope and objective of audit engagement
Training plan for audit staff
IS audit function role
Choice D is applicable in this scenario. Choice A is responsibility of audit management. Scope and objective is agreed on engagement letter and training of staff is again responsibility of audit management based on audit plan.
In the evaluation of risk assessment of Information system. The IS auditor will first review:
Controls in place
Effectiveness of implemented controls
Monitoring mechanism for risks related to assets
Threats/ vulnerabilities impacting assets
Risks associated with using assets need to be evaluated first so choice D is most appropriate in this scenario. Controls effectiveness is part of risk mitigation stage and risk monitoring is part of risk monitoring function after risk assessment phase.
During an audit plan, the most critical step is:
High risk areas identification
Skill set identification of audit team
Identification of test steps in audit
Identification of time allotted to audit
The choice A is appropriate in this scenario. The identification of high risk areas is most critical step as that will determine the areas to be focused during the audit. Skill set is determined before audit to begin. Test steps and time for audit is determined on the basis of areas to be audited.
How much data to be collected during audit process will be determined on the basis of:
Ease of obtaining the information records
Familiarity with the environment to be audited
Ease of obtaining the evidence
Scope and purpose of audit
Scope and purpose will determine the amount of sample data to be collected during the audit. All other choices are irrelevant in this scenario as audit process is not hampered by ease of obtaining records or evidences or familiarity with the environment.
During the audit plan, assessment of risk should provide:
An assurance that audit will cover material items
Material items would be covered definitely during the audit work
Reasonable assurance that All items will be covered by audit work
Assurance to suffice that all items will be covered during the audit work
Choice A. ISACA audit guideline G15 clearly states that “An assessment of risk should be made to provide reasonable assurance that material items will be adequately covered during the audit work”. Definite assurance clause in choice B is impractical, option C is also not correct as it states all items.
Statistical sampling should be used by IS auditor and not judgmental sampling in the scenario:
Objective quantification of error probability
Avoidance of sampling risk by auditor
General use audit software is available
Unable to determine the tolerable error rate
With an expected error rate and confidence level, objective method of sampling is statistical in nature as it helps auditor to determine size of sample and quantify error probability or likelihood. Choice B is not correct because sampling risk is risk of sample. Choice C is also incorrect as statistical sampling doesn’t need general software. Choice D is also incorrect because tolerable error rate is predetermined in statistical and judgmental sampling.
The primary goal of an auditor during the IS audit planning stage is:
Address audit objectives
Sufficient evidence collection
Mention appropriate tests
Use less audit resources
As per ISACA guidelines auditor plan must address audit objectives. Choice B is not correct because evidence is not collected at planning stage. Choice C and D are also incorrect because they are not initial goals of audit plan.
During an audit procedure selection, auditor will have to use professional judgment to ascertain:
Sufficient evidence collection
Identification of significant deficiencies and there correction in reasonable time period
Material weakness identified
Maintain minimal level of audit costs
Professional judgment during the course of an audit process involves subjective and qualitative evaluation of conditions. It is based more on past experience of auditor and auditor past experience plays a key role in this. Identification of material weaknesses is result of experience and planning thoroughness and also it does not deal with financial aspects of audit as stated in choice D.
While evaluating logical access controls an auditor first:
Documentation of controls applied to all possible access paths to system
Testing of controls to access paths to determine they are functional
Evaluation of security environment w.r.t. policies and procedures laid down
Obtaining an understanding of security risks to information processing facilities
Choice D is most appropriate in this scenario. The first step is to gather security risks to information processing facilities, by studying documentation, inquiries and doing risk assessment. Documentation and evaluation is next step. Third step is to test access paths to ensure controls functionality. The last is auditor evaluation of security environment.
The objective of forensic audit is to:
Participation in investigations related to corporate fraud
Evidence collection on systematic basis after system irregularity
Assessment of correctness of organization’s financial statements
Determine if there was any criminal activity
Choice B is correct as evidence collection is used for juridical process. They are not only for corporate frauds. Financial statements correctness determination is not purpose of forensic audit. And criminal activity could be part of legal process but it is not the objective of forensic audit.
An auditor is reviewing a backup log report of remote server backup. One of the entries in the backup log indicates failure to login to remote server for backup and there is no entry in log which confirms that backup was restarted. What IS auditor should do?
Issue audit finding
Explanation required from IS management
Issue a non compliance
Increase sample of logs to be reviewed
Choice D is appropriate in this case. Before issue audit finding or seeking explanation, or issue of non compliance auditor needs to gather additional evidence to properly evaluate the situation.
For the purpose of auditing critical servers audit trail, auditor wants to use _______ tool to determine the potential irregularity in the user or system.
Embedded data collection tool
Heuristics scanning tool
Trend/variance detection tools
Trend/variance detection tools are used for determining the potential irregularity in the user or system. CASE tools are used in software development and embedded data collection tool is used for sample collection and Heuristics scanning tool used to detect virus infections.
What could be the possible cause of great concern for an auditor while evaluating a corporate network for possible penetration from employees?
Number of external modems connected to network
Users have right to install software on there desktops
Limited network monitoring or no monitoring at all
User ids with identical passwords
Choice D is most appropriate in this scenario. It is the greatest threat. Choice A threat is there but depends on use of valid user id. In choice b likelihood is not high due to technical knowledge needed for penetration. Network monitoring is a means for detection.
What is the major benefit of using computer forensic software’s in investigations?
Preservation of electronic evidence
Saving time and costs
More efficient and effective
Efficient search for violation of Intellectual property rights
The main purpose of forensic software is to preserve the chain of electronic evidence for investigation purpose. Others choice B and C are concerns to identify good / poor forensic software. Choice D is example of using forensic software.
Data is imported from client database by auditor, now the next step is to confirm imported data is complete, what step need to be followed to verify the same.
Match control total of imported data with original data
Sort data to confirm data is in same order as the original data
Review first 100 records of imported data with first 100 records of original data
Category wise filtering of data and matching them to original data
The logical step in this scenario would be option A. this will confirm the completeness of process. Sorting may not be applicable in this scenario because original data may not be sorted order. Reviewing partial data does not suffice the purpose either. Filtering data would also need control totals to be established to ensure completeness of data.
An audit is to be conducted to identify payroll overpayments in last year. Which audit technique would be best appropriate in this scenario?
Use of general audit software
Integrated test facility
Embedded audit module
General auditing software’s include mathematical calculations, stratification, statistical analysis, sequence and duplicate checks and re-computations. So auditor can use appropriate tests to re-compute payroll data. Test data would not detect the anomalies and overpayments. Integrated test facility and embedded edit modules cannot detect previous errors.
During an audit process, auditor finds out that security procedures are not documented what he should do?
Auditor create procedure document
Do compliance testing
Evaluate and identify exiting practices being followed
The purpose of audit is to identify risks, so the most appropriate approach would be identify and evaluate current practices being followed. Auditors don’t create documentation, compliance testing cannot be done as no document is there and stopping audit will jeopardize the objective of audit i.e. risks identification.
Threats and their potential impacts are identified during the course of an risk analysis stage what should be next most appropriate step?
Identification and assessment of risk assessment approach of management
Identification of all information assets and systems
Disclosure of threats and impacts to management
Identification and evaluation of existing controls
The next step would be choice D. once the threats and impacts are identified. Next step is to share them with management.
Out of the following which one is the most significant concern for an auditor?
Non reporting of network attack
Notification failure to police of an attempted intrusion
Periodic review of access rights not present
No notification of intrusion to public
Failure to report a network attack is major cause of concern. Reporting to public is organization choice and notification to police is also matter of choice. Periodic examination of access rights could be causing of concern but not as big as option A.
Which is the most dependable evidence for an auditor out of the following:
Letter from 3rd party on compliance
Line management assurance that application is performing as per design
Information obtained from www
Reports supplied by organization management to auditor
The most reliable evidence is the one given by external party. Choice B, C and D are not considered reliable.
While evaluating a process on the basis of preventive, detective and corrective controls, an IS auditor should know?
The point at which controls used as data flow through system
Preventive and detectives controls are only relevant ones
Corrective controls are only relevant
Classification is required to determine which controls are absent
Choice A is most appropriate. Choice B and C are incorrect as all controls are important. Choice D is also not correct because functioning of controls is important and not its classification.
The best evidence of duties segregation is identified by using ____ audit technique?
Discussions with management
Organization chart review
Interviews and observations
User access rights testing
Based on choice C an auditor can evaluate the duties segregation. Management may not be aware of detailed functioning, organization chart only depicts hierarchy of reporting, and testing will only tell user rights but will not give any details on function being performed by users.
While reviewing a customer master file, auditor discovers that many customer names are appearing in duplicate causing variation in customer first names. How auditor will determine the amount of duplication in this scenario?
Testing data to validate input
Testing data to check sorting capabilities
Use general audit software to detect address field duplications
Use general audit software to detect account field duplications
As names are not same, so we need to use some other field to determine duplication such as address field. Test data will not help in this case and searching on account number may not yield desired result because customers could have different account numbers for each entry.
While testing for program changes what is the best population to choose sample from?
Library listings testing
Listing of source programs
Change request programs
Listing of production library
The best source to draw sample or test system is automated system. Choice B would be time consuming. Program change request are initial documents to initiate changes; test libraries don’t present approved and authorized executables.
An integrated test facility is an efficient tool for audit:
Audit of application control in a cost effective manner
Integrating audit tests for financial and IS auditors
Comparison of processing output with independently calculated data
Tool to analyze large range of information
It is a useful audit tool because it uses similar program to compare processing with independently calculated data. This involves setting up dummy entities and processing test/production data.
IS auditors use data flow diagrams to:
Hierarchical ordering of data
Highlighting high level data definitions
Summarize data paths and storage in graphical manner
Step by step details of data generation portrait
Data flow diagrams are used to chart flow of data and storage. They don’t order data in hierarchical manner. Data flow not necessarily match hierarchy or order of data generation.
Review of organization chart is done by auditor to:
Identify all communication channels
Responsibility and authority of individuals
Network diagram connected to different employees
Organization chart always depicts the responsibility and authority of individuals in an organization. This is required to understand the segregation of functions.
While performing an audit of network operating system, an auditor should review the following user feature?
Network document availability online
Support for terminal access to remote systems
File transfer handling between users and hosts
Audit, control and performance management
Network operating system user features comprise online availability of network documentation. Choice B, C and D are some examples of network OS functions.
In order to ascertain that access to program documentation is only restricted to authorize users, an auditor should check:
Evaluation of retention plan for off site storage
Procedures being followed by programmers
Comparison of utilization records to operational schedule
Review data access records
Interview of programmers to understand procedures being followed is the best way to ascertain the access to program documentation is only with authorized personnel. Off site storage, utilization records and review of data access records will not address security of program documentation.
Auditor is evaluating an application which does computation of payments. During the audit it is reveled that 50% of calculation is not matching with the set total. What should be the next step auditor need to follow as part of audit practice?
Do further test on calculations having error
Identification of variables that generated inaccurate test results
Testify some more test cases to reconfirm the anomaly
Documentation of results, findings, conclusions and recommendations
Auditor needs to examine some more test cases where incorrect calculations happened and then confirm with the final outcome. Once calculations are complete further tests can be performed and then report to be made only after confirmation and not before that.
In order to prove the correctness of system tax calculation the best practice to be followed is:
In depth review and analysis of source code
Using general auditing software to recreate program logic for monthly totals calculation
Simulate transactions for results comparison
In depth analysis and flow chart preparation of the source code
The best way to prove accuracy of tax calculation is simulation of transactions. Detailed review, flow chart and analysis of source code will not be effective and monthly total will not confirm the correctness of tax calculations at individual level.
In Applications control review , auditor must analyze :
Application efficiency in meeting business processes
Business processes performed by application
Optimization of application
Application control review requires analysis of application automated controls and analysis of exposures due to controls weaknesses. The other options could be objective of audit but not specifically meant to analyze application controls.
What is the most accurate evidence to prove that purchase orders are legitimate while auditing an inventory application?
Application parameters can be modified by unauthorized personnel
Purchase order tracing
Comparison of receiving reports to purchase order details
Application documentation review
Access control testing is the best way to determine purchase orders legitimacy and is the best evidence. Choice B and C are part of further actions and choice D will not serve the purpose as application documentation process and actual process could vary.
Irregularities at an early stage can be detected in the best manner by using ______ online auditing technique.
Embedded audit module
Integrated test facility
The audit book technique also involves embedding code in applications to reveal early detection of irregularity. Embedded audit module is used for monitoring application systems on select
Cite This Work
To export a reference to this article please select a referencing stye below:
Related ServicesView all
DMCA / Removal Request
If you are the original writer of this essay and no longer wish to have your work published on UKEssays.com then please: