CISA

Which of the following is the PRIMARY objective of an information systems audit?

• ATo identify all security vulnerabilities in the system
• BTo evaluate controls and provide assurance that business objectives are being met
• CTo ensure compliance with all applicable laws and regulations
• DTo recommend specific technical solutions for identified weaknesses

An IS auditor discovers that an organization lacks a formal audit charter. What is the MOST significant risk associated with this finding?

• AThe audit department may exceed its budget
• BThe audit function may lack authority and independence
• CAudit reports may not be distributed to the appropriate stakeholders
• DThe audit schedule may not be followed consistently

During risk assessment, an IS auditor identifies a high-risk area with inadequate controls. What should be the auditor's NEXT step?

• AImmediately report the finding to the board of directors
• BDevelop detailed recommendations for control implementation
• CEvaluate compensating controls and gather additional evidence
• DSuspend the audit until management implements new controls

Which of the following BEST describes the concept of audit risk?

• AThe probability that the auditor will issue an incorrect opinion
• BThe likelihood that the organization will experience a security breach
• CThe chance that audit findings will not be implemented by management
• DThe possibility that the audit will exceed its planned budget

An IS auditor is planning to use Computer-Assisted Audit Techniques (CAATs) to test a large dataset. What is the PRIMARY advantage of this approach?

• AIt eliminates the need for management approval
• BIt allows testing of 100% of transactions rather than sampling
• CIt automatically generates audit findings and recommendations
• DIt replaces the need for auditor judgment and experience

Which of the following is MOST important when determining the scope of an IS audit?

• AThe technical complexity of the systems being audited
• BThe assessed risk and materiality of the area under review
• CThe availability of audit staff with specialized skills
• DThe time elapsed since the previous audit was conducted

An IS auditor observes that a control was bypassed by an IT administrator in a documented emergency. What should the auditor conclude?

• AThe control is ineffective and should be eliminated
• BThe control is effective as the bypass was documented
• CThe effectiveness depends on whether the bypass was authorized and followed proper proced…
• DThe administrator should be terminated immediately

What is the PRIMARY purpose of continuous auditing?

• ATo replace the need for periodic manual audits
• BTo provide more timely assurance on controls and risk
• CTo reduce the cost of external audit fees
• DTo eliminate the need for audit planning activities

When sampling for audit evidence, which factor is MOST important in determining sample size?

• AThe auditor's years of experience
• BThe desired level of confidence and tolerable error rate
• CThe number of available audit staff
• DThe total number of IT systems in the organization

Which of the following is the PRIMARY responsibility of the board of directors regarding IT governance?

• ADeveloping detailed technical specifications for IT projects
• BOverseeing day-to-day IT operations and troubleshooting
• CSetting strategic direction and ensuring IT supports business objectives
• DWriting code for critical business applications

An IS auditor finds that IT policies have not been reviewed in three years. What is the PRIMARY concern?

• AThe policies may not reflect current business practices and risks
• BThe audit will take longer to complete
• CEmployees will not understand their job responsibilities
• DThe IT department budget may be reduced

In an effective IT governance framework, who should be responsible for defining risk appetite?

• AThe CIO (Chief Information Officer)
• BThe IT security manager
• CThe board of directors or executive management
• DThe external auditors

Which of the following is the BEST indicator of effective IT governance?

• AAll IT projects are completed under budget
• BIT strategy is aligned with business strategy and value is being delivered
• CThere have been no IT security incidents
• DAll IT staff have relevant technical certifications

An IS auditor discovers that key IT personnel have not taken vacation in over two years. What type of risk does this present?

• AStrategic risk due to potential staff burnout
• BOperational risk due to lack of succession planning
• CFraud risk due to opportunity for concealment of irregularities
• DCompliance risk due to labor law violations

Which IT governance framework emphasizes the separation of duties between IT operations and IT development?

• ACOSO
• BCOBIT
• CITIL
• DISO 27001