Cisa Questionnaire The Is Audit Process Information Technology Essay

This is sampling example of compliance, as it states whether controls are functional as per the policy. This will include taking samples of new user account creation forms and match it to ensure process is being followed. Variable sampling is used to determine numerical value. Substantive sampling tests the integrity of process such as credit / debit values, balances on financial statements. Stop or go sampling technique prohibits excessive sampling of an attribute.

The Stop and go statistical sampling technique in a scenario where it is believed or perceived that relatively few errors will be exposed, so there is point in wasting over sampling of an attribute.

“Use of statistical sample for tape library inventory” is an example of ____ type of sampling technique.

Variable

Substantive

Compliance

Stop or go

Ans. B

Explanation

This is an example of substantive sampling which confirms the integrity of a process. This test will determine whether tape library records are stated in a correct manner.

What is the major benefit of risk based audit planning approach?

Planning scheduling in advance over months

Staff exposure to varied technologies

Resources allocation to areas of top concern

Budget requirements are met by audit staff

Ans. C

Explanation

The objective of risk based audit approach is focus on areas where risk is high. Various scheduling methods are used to prepare audit schedules and it does not come under risk based approach. It also does not relate to budget requirements met by staff and number of audits performed in a given year.

Examples of substantive sampling technique include:

Review of password history reports

Approval for configuration parameters changes

Tape library inventory

Verifying list of exception reports

Ans. C

Explanation

Tape library inventory is an example of substantive sampling as it confirms the integrity of a process associated with determining whether tape records are stated in a correct manner. All others are example of compliance sampling as they determine whether the process in practice is inline with the established policies and procedures.

The characteristic of an audit charter is:

Is dynamic is nature and keeps changing frequently as the technology changes

It contains the objectives of audit, maintenance and review of internal records by delegated authority

Detailed audit procedures

Overall scope, ownership and responsibility of audit function

Ans. D

Explanation

Audit charter states management objectives, scope, ownership and delegation of responsibility of audit function. It should not change frequently and approved by higher management. Also it does not contain detail audit procedures.

The auditor actions and decisions impact the ___ type of risk in a major manner.

Inherent

Detection

Control

Business

Ans. B

Explanation

Auditor selection / decisions during the audit process have direct impact on detection risks, such as enough number of samples not taken into consideration etc. Company actions manage the control risks and business and inherent risks are also not impacted by auditor.

Particular threat to overall business risk can be articulated in terms of:

Likelihood and magnitude of impact , where threat successfully exploited a vulnerability

Magnitude of impact, where source of threat successfully exploited a vulnerability

Probability of a given source of threat exploiting a vulnerability

Risk assessment team group decision

Ans. A

Explanation

The choice A addresses both likelihood and magnitude of impact and measures risk to an asset in best manner. Choice B doesn’t consider the magnitude of possible damage to an asset. Choice C don’t consider the possibility of damage due to source threat exploiting a vulnerability and choice D is an arbitrary method of determining risk and it is not a scientific risk management approach.

Risk management approach over baseline approach in information security management gives a major advantage in terms of:

Overprotection of information assets

Base level protection to all assets irrespective of asset value

Adequate protection applied to all information assets

Equal level of protection for all information assets

Ans. C

Explanation

Baseline approach applies a standard set of protection to all information assets whereas the risk management based approach determines the level of protection to be applied depending on a given level of risk. This saves the costs incurred on overprotection of an information asset. In baseline approach equal level of protection is applied for all information assets irrespective of asset value so as a result some assets could be under protective and some could be overprotective.

Which testing method is most effective when doing the compliance testing?

Attribute sampling

Variable sampling

Stratified mean per unit

Difference estimation

Ans. A

Explanation

Choice A is appropriate in this scenario. As attribute sampling model estimate the rate of occurrence of a specific quality in a population to confirm whether quality is present in compliance testing. The other means of sampling are used in substantive testing where details and quantity testing is done.

Why email is considered a useful source of evidence in litigation in IS audit process?

Wide use of email systems in enterprises as medium of communication

Access control mechanisms to establish email communication accountability

Backup and archiving of information flowing through email systems

Data classification guidelines dictating information flow via email systems

Ans. C

Explanation

Option C is most appropriate as archived/ backed up email files, may contain documents which have been deleted and could be recovered. Access controls only establish accountability but don’t give evidence of the email. Data classification standardizes what to be communicated by email but don’t provide information needed for litigation process.

A post implementation review of an application is scheduled by IS auditor. What could be the possible situation which can hamper the independent assessment of IS auditor.

Involved in the development of specific application and implemented specific functionality / control

Integrated an embedded audit module in the application for auditing purpose

Was member of application system project team but not involved at operational level

Given advice on considering best practices while system was in development stage

Ans. A

Explanation

Choice A is most appropriate in this scenario because the auditor independence is impaired in case he was involved actively during the development, acquisition and implementation of the new application. Choice B and C don’t hamper auditor independence. And Choice D is not correct as auditor independence is not hampered by given advice on best known practices.

What is the benefit of continuous audit approach:

Collection of evidence is not required on system reliability during the processing stage

Review and follow up on all information collected

Improvement in overall security in time sharing environment where large number of transactions processed

No dependency on complexity of organization’s systems

Ans. C

Explanation

Choice C is most appropriate w.r.t to continuous audit process major benefit as overall security is improved in time sharing environments where large number of transactions is processed but leaving insufficient trail of papers. Choice A is not correct as auditor need to collect evidence while processing is ON. Choice B is also not correct in this case as auditor does review and follows up on errors and material deficiency. Choice D is also incorrect as complexity of organization systems determines the use of continuous audit process technique.

The objective of enabling audit trail is:

Better response time for users

Institute Accountability of processed transactions

Improving operational efficiency of systems

Better tracking of transactions to give useful information to auditors

Ans. B

Explanation

Choice B is most appropriate in this scenario as accountability and responsibility can be established for processed transactions and tracing could be done end to end. Enabling audit trail don’t improve user experience as it might involve additional processing which may impact user response time in other way. Choice D could also be considered valid but it is not the main reason for the purpose of enabling audit trails.

In a risk based audit strategy, risk assessment is done by IS auditor to ensure:

Risk mitigation controls are in place

Threats and vulnerabilities are identified

Risks related to audit are taken into consideration

Gap analysis is done as per the need

Ans. B

Explanation

Choice B is most appropriate in this scenario. Identification of threats and vulnerabilities is crucial in determining the scope of audit. Effect of an audit would be to develop controls to mitigate risks. Audit risks are not relevant to risk analysis of environment. Gap analysis compares the actual state to expected or desired state. A gap could be result of a risk not being correctly addressed or missed out.

In order to achieve best value to organization in terms of audit resources we should :

Do audit scheduling and measure the time spent on audits

Training of audit staff on latest audit technologies

Chalk out detailed plan based on risk assessment

Progress monitoring of audits and have cost control measures in place

Ans. C

Explanation

Choice C is most appropriate in this scenario. This will deliver value to organization in terms of dedicating resources on higher risk areas. Choice A, B and D will improve the staff productivity only.

An IS audit charter includes:

Plan for IS audit engagements

Scope and objective of audit engagement

Training plan for audit staff

IS audit function role

Ans. D

Explanation

Choice D is applicable in this scenario. Choice A is responsibility of audit management. Scope and objective is agreed on engagement letter and training of staff is again responsibility of audit management based on audit plan.

In the evaluation of risk assessment of Information system. The IS auditor will first review:

Controls in place

Effectiveness of implemented controls

Monitoring mechanism for risks related to assets

Threats/ vulnerabilities impacting assets

Ans. D

Explanation

Risks associated with using assets need to be evaluated first so choice D is most appropriate in this scenario. Controls effectiveness is part of risk mitigation stage and risk monitoring is part of risk monitoring function after risk assessment phase.

During an audit plan, the most critical step is:

High risk areas identification

Skill set identification of audit team

Identification of test steps in audit

Identification of time allotted to audit

Ans. A

Explanation

The choice A is appropriate in this scenario. The identification of high risk areas is most critical step as that will determine the areas to be focused during the audit. Skill set is determined before audit to begin. Test steps and time for audit is determined on the basis of areas to be audited.

How much data to be collected during audit process will be determined on the basis of:

Ease of obtaining the information records

Familiarity with the environment to be audited

Ease of obtaining the evidence

Scope and purpose of audit

Ans. D

Explanation

Scope and purpose will determine the amount of sample data to be collected during the audit. All other choices are irrelevant in this scenario as audit process is not hampered by ease of obtaining records or evidences or familiarity with the environment.

During the audit plan, assessment of risk should provide:

An assurance that audit will cover material items

Material items would be covered definitely during the audit work

Reasonable assurance that All items will be covered by audit work

Assurance to suffice that all items will be covered during the audit work

Ans. A

Explanation

Choice A. ISACA audit guideline G15 clearly states that “An assessment of risk should be made to provide reasonable assurance that material items will be adequately covered during the audit work”. Definite assurance clause in choice B is impractical, option C is also not correct as it states all items.

Statistical sampling should be used by IS auditor and not judgmental sampling in the scenario:

Objective quantification of error probability

Avoidance of sampling risk by auditor

General use audit software is available

Unable to determine the tolerable error rate

Ans. A

Explanation

With an expected error rate and confidence level, objective method of sampling is statistical in nature as it helps auditor to determine size of sample and quantify error probability or likelihood. Choice B is not correct because sampling risk is risk of sample. Choice C is also incorrect as statistical sampling doesn’t need general software. Choice D is also incorrect because tolerable error rate is predetermined in statistical and judgmental sampling.

The primary goal of an auditor during the IS audit planning stage is:

Address audit objectives

Sufficient evidence collection

Mention appropriate tests

Use less audit resources

Ans. A

Explanation

As per ISACA guidelines auditor plan must address audit objectives. Choice B is not correct because evidence is not collected at planning stage. Choice C and D are also incorrect because they are not initial goals of audit plan.

During an audit procedure selection, auditor will have to use professional judgment to ascertain:

Sufficient evidence collection

Identification of significant deficiencies and there correction in reasonable time period

Material weakness identified

Maintain minimal level of audit costs

Ans. A

Explanation

Professional judgment during the course of an audit process involves subjective and qualitative evaluation of conditions. It is based more on past experience of auditor and auditor past experience plays a key role in this. Identification of material weaknesses is result of experience and planning thoroughness and also it does not deal with financial aspects of audit as stated in choice D.

While evaluating logical access controls an auditor first:

Documentation of controls applied to all possible access paths to system

Testing of controls to access paths to determine they are functional

Evaluation of security environment w.r.t. policies and procedures laid down

Obtaining an understanding of security risks to information processing facilities

Ans. D

Explanation

Choice D is most appropriate in this scenario. The first step is to gather security risks to information processing facilities, by studying documentation, inquiries and doing risk assessment. Documentation and evaluation is next step. Third step is to test access paths to ensure controls functionality. The last is auditor evaluation of security environment.

The objective of forensic audit is to:

Participation in investigations related to corporate fraud

Evidence collection on systematic basis after system irregularity

Assessment of correctness of organization’s financial statements

Determine if there was any criminal activity

Ans. B

Explanation

Choice B is correct as evidence collection is used for juridical process. They are not only for corporate frauds. Financial statements correctness determination is not purpose of forensic audit. And criminal activity could be part of legal process but it is not the objective of forensic audit.

An auditor is reviewing a backup log report of remote server backup. One of the entries in the backup log indicates failure to login to remote server for backup and there is no entry in log which confirms that backup was restarted. What IS auditor should do?

Issue audit finding

Explanation required from IS management

Issue a non compliance

Increase sample of logs to be reviewed

Ans. D

Explanation

Choice D is appropriate in this case. Before issue audit finding or seeking explanation, or issue of non compliance auditor needs to gather additional evidence to properly evaluate the situation.

For the purpose of auditing critical servers audit trail, auditor wants to use _______ tool to determine the potential irregularity in the user or system.

CASE tools

Embedded data collection tool

Heuristics scanning tool

Trend/variance detection tools

Ans. D

Explanation

Trend/variance detection tools are used for determining the potential irregularity in the user or system. CASE tools are used in software development and embedded data collection tool is used for sample collection and Heuristics scanning tool used to detect virus infections.

What could be the possible cause of great concern for an auditor while evaluating a corporate network for possible penetration from employees?

Number of external modems connected to network

Users have right to install software on there desktops

Limited network monitoring or no monitoring at all

User ids with identical passwords

Ans. D

Explanation

Choice D is most appropriate in this scenario. It is the greatest threat. Choice A threat is there but depends on use of valid user id. In choice b likelihood is not high due to technical knowledge needed for penetration. Network monitoring is a means for detection.

What is the major benefit of using computer forensic software’s in investigations?

Preservation of electronic evidence

Saving time and costs

More efficient and effective

Efficient search for violation of Intellectual property rights

Ans. A

Explanation

The main purpose of forensic software is to preserve the chain of electronic evidence for investigation purpose. Others choice B and C are concerns to identify good / poor forensic software. Choice D is example of using forensic software.

Data is imported from client database by auditor, now the next step is to confirm imported data is complete, what step need to be followed to verify the same.

Match control total of imported data with original data

Sort data to confirm data is in same order as the original data

Review first 100 records of imported data with first 100 records of original data

Category wise filtering of data and matching them to original data

Ans. A

Explanation

The logical step in this scenario would be option A. this will confirm the completeness of process. Sorting may not be applicable in this scenario because original data may not be sorted order. Reviewing partial data does not suffice the purpose either. Filtering data would also need control totals to be established to ensure completeness of data.

An audit is to be conducted to identify payroll overpayments in last year. Which audit technique would be best appropriate in this scenario?

Data testing

Use of general audit software

Integrated test facility

Embedded audit module

Ans. B

Explanation

General auditing software’s include mathematical calculations, stratification, statistical analysis, sequence and duplicate checks and re-computations. So auditor can use appropriate tests to re-compute payroll data. Test data would not detect the anomalies and overpayments. Integrated test facility and embedded edit modules cannot detect previous errors.

During an audit process, auditor finds out that security procedures are not documented what he should do?

Auditor create procedure document

Stop audit

Do compliance testing

Evaluate and identify exiting practices being followed

Ans. D

Explanation

The purpose of audit is to identify risks, so the most appropriate approach would be identify and evaluate current practices being followed. Auditors don’t create documentation, compliance testing cannot be done as no document is there and stopping audit will jeopardize the objective of audit i.e. risks identification.

Threats and their potential impacts are identified during the course of an risk analysis stage what should be next most appropriate step?

Identification and assessment of risk assessment approach of management

Identification of all information assets and systems

Disclosure of threats and impacts to management

Identification and evaluation of existing controls

Ans. D

Explanation

The next step would be choice D. once the threats and impacts are identified. Next step is to share them with management.

Out of the following which one is the most significant concern for an auditor?

Non reporting of network attack

Notification failure to police of an attempted intrusion

Periodic review of access rights not present

No notification of intrusion to public

Ans. A

Explanation

Failure to report a network attack is major cause of concern. Reporting to public is organization choice and notification to police is also matter of choice. Periodic examination of access rights could be causing of concern but not as big as option A.

Which is the most dependable evidence for an auditor out of the following:

Letter from 3rd party on compliance

Line management assurance that application is performing as per design

Information obtained from www

Reports supplied by organization management to auditor

Ans. A

Explanation

The most reliable evidence is the one given by external party. Choice B, C and D are not considered reliable.

While evaluating a process on the basis of preventive, detective and corrective controls, an IS auditor should know?

The point at which controls used as data flow through system

Preventive and detectives controls are only relevant ones

Corrective controls are only relevant

Classification is required to determine which controls are absent

Ans. A

Explanation

Choice A is most appropriate. Choice B and C are incorrect as all controls are important. Choice D is also not correct because functioning of controls is important and not its classification.

The best evidence of duties segregation is identified by using ____ audit technique?

Discussions with management

Organization chart review

Interviews and observations

User access rights testing

Ans. C

Explanation

Based on choice C an auditor can evaluate the duties segregation. Management may not be aware of detailed functioning, organization chart only depicts hierarchy of reporting, and testing will only tell user rights but will not give any details on function being performed by users.

While reviewing a customer master file, auditor discovers that many customer names are appearing in duplicate causing variation in customer first names. How auditor will determine the amount of duplication in this scenario?

Testing data to validate input

Testing data to check sorting capabilities

Use general audit software to detect address field duplications

Use general audit software to detect account field duplications

Ans. C

Explanation

As names are not same, so we need to use some other field to determine duplication such as address field. Test data will not help in this case and searching on account number may not yield desired result because customers could have different account numbers for each entry.

While testing for program changes what is the best population to choose sample from?

Library listings testing

Listing of source programs

Change request programs

Listing of production library

Ans. D

Explanation

The best source to draw sample or test system is automated system. Choice B would be time consuming. Program change request are initial documents to initiate changes; test libraries don’t present approved and authorized executables.

An integrated test facility is an efficient tool for audit:

Audit of application control in a cost effective manner

Integrating audit tests for financial and IS auditors

Comparison of processing output with independently calculated data

Tool to analyze large range of information

Ans. C

Explanation

It is a useful audit tool because it uses similar program to compare processing with independently calculated data. This involves setting up dummy entities and processing test/production data.

IS auditors use data flow diagrams to:

Hierarchical ordering of data

Highlighting high level data definitions

Summarize data paths and storage in graphical manner

Step by step details of data generation portrait

Ans. C

Explanation

Data flow diagrams are used to chart flow of data and storage. They don’t order data in hierarchical manner. Data flow not necessarily match hierarchy or order of data generation.

Review of organization chart is done by auditor to:

Understand workflows

Identify all communication channels

Responsibility and authority of individuals

Network diagram connected to different employees

Ans. C

Explanation

Organization chart always depicts the responsibility and authority of individuals in an organization. This is required to understand the segregation of functions.

While performing an audit of network operating system, an auditor should review the following user feature?

Network document availability online

Support for terminal access to remote systems

File transfer handling between users and hosts

Audit, control and performance management

Ans. A

Explanation

Network operating system user features comprise online availability of network documentation. Choice B, C and D are some examples of network OS functions.

In order to ascertain that access to program documentation is only restricted to authorize users, an auditor should check:

Evaluation of retention plan for off site storage

Procedures being followed by programmers

Comparison of utilization records to operational schedule

Review data access records

Ans. B

Explanation

Interview of programmers to understand procedures being followed is the best way to ascertain the access to program documentation is only with authorized personnel. Off site storage, utilization records and review of data access records will not address security of program documentation.

Auditor is evaluating an application which does computation of payments. During the audit it is reveled that 50% of calculation is not matching with the set total. What should be the next step auditor need to follow as part of audit practice?

Do further test on calculations having error

Identification of variables that generated inaccurate test results

Testify some more test cases to reconfirm the anomaly

Documentation of results, findings, conclusions and recommendations

Ans. C

Explanation

Auditor needs to examine some more test cases where incorrect calculations happened and then confirm with the final outcome. Once calculations are complete further tests can be performed and then report to be made only after confirmation and not before that.

In order to prove the correctness of system tax calculation the best practice to be followed is:

In depth review and analysis of source code

Using general auditing software to recreate program logic for monthly totals calculation

Simulate transactions for results comparison

In depth analysis and flow chart preparation of the source code

Ans. C

Explanation

The best way to prove accuracy of tax calculation is simulation of transactions. Detailed review, flow chart and analysis of source code will not be effective and monthly total will not confirm the correctness of tax calculations at individual level.

In Applications control review , auditor must analyze :

Application efficiency in meeting business processes

Exposures impact

Business processes performed by application

Optimization of application

Ans. B

Explanation

Application control review requires analysis of application automated controls and analysis of exposures due to controls weaknesses. The other options could be objective of audit but not specifically meant to analyze application controls.

What is the most accurate evidence to prove that purchase orders are legitimate while auditing an inventory application?

Application parameters can be modified by unauthorized personnel

Purchase order tracing

Comparison of receiving reports to purchase order details

Application documentation review

Ans. A

Explanation

Access control testing is the best way to determine purchase orders legitimacy and is the best evidence. Choice B and C are part of further actions and choice D will not serve the purpose as application documentation process and actual process could vary.

Irregularities at an early stage can be detected in the best manner by using ______ online auditing technique.

Embedded audit module

Integrated test facility

Snapshots

Audit books

Ans. D

Explanation

The audit book technique also involves embedding code in applications to reveal early detection of irregularity. Embedded audit module is used for monitoring application systems on select