Cisa Questionnaire The Is Audit Process Information Technology Essay

Cisa Questionnaire The Is Audit Process Information Technology Essay This is sampling example of compliance, as it states whether controls are functional as per the policy. This will include taking samples of new user account creation forms and match it to ensure process is being followed. Variable sampling is used to determine numerical value. Substantive sampling tests the integrity of process such as credit / debit values, balances on financial statements. Stop or go sampling technique prohibits excessive sampling of an attribute. The Stop and go statistical sampling technique in a scenario where it is believed or perceived that relatively few errors will be exposed, so there is point in wasting over sampling of an attribute. Use of statistical sample for tape library inventory is an example of ____ type of sampling technique. Variable Substantive Compliance Stop or go Ans. B Explanation This is an example of substantive sampling which confirms the integrity of a process. This test will determine whether tape library records are stated in a correct manner. What is the major benefit of risk based audit planning approach? Planning scheduling in advance over months Staff exposure to varied technologies Resources allocation to areas of top concern Budget requirements are met by audit staff Ans. C Explanation The objective of risk based audit approach is focus on areas where risk is high. Various scheduling methods are used to prepare audit schedules and it does not come under risk based approach. It also does not relate to budget requirements met by staff and number of audits performed in a given year. Examples of substantive sampling technique include: Review of password history reports Approval for configuration parameters changes Tape library inventory Verifying list of exception reports Ans. C Explanation Tape library inventory is an example of substantive sampling as it confirms the integrity of a process associated with determining whether tape records are stated in a correct manner. All others are example of compliance sampling as they determine whether the process in practice is inline with the established policies and procedures. The characteristic of an audit charter is: Is dynamic is nature and keeps changing frequently as the technology changes It contains the objectives of audit, maintenance and review of internal records by delegated authority Detailed audit procedures Overall scope, ownership and responsibility of audit function Ans. D Explanation Audit charter states management objectives, scope, ownership and delegation of responsibility of audit function. It should not change frequently and approved by higher management. Also it does not contain detail audit procedures. The auditor actions and decisions impact the ___ type of risk in a major manner. Inherent Detection Control Business Ans. B Explanation Auditor selection / decisions during the audit process have direct impact on detection risks, such as enough number of samples not taken into consideration etc. Company actions manage the control risks and business and inherent risks are also not impacted by auditor. Particular threat to overall business risk can be articulated in terms of: Likelihood and magnitude of impact , where threat successfully exploited a vulnerability Magnitude of impact, where source of threat successfully exploited a vulnerability Probability of a given source of threat exploiting a vulnerability Risk assessment team group decision Ans. A Explanation The choice A addresses both likelihood and magnitude of impact and measures risk to an asset in best manner. Choice B doesnt consider the magnitude of possible damage to an asset. Choice C dont consider the possibility of damage due to source threat exploiting a vulnerability and choice D is an arbitrary method of determining risk and it is not a scientific risk management approach. Risk management approach over baseline approach in information security management gives a major advantage in terms of: Overprotection of information assets Base level protection to all assets irrespective of asset value Adequate protection applied to all information assets Equal level of protection for all information assets Ans. C Explanation Baseline approach applies a standard set of protection to all information assets whereas the risk management based approach determines the level of protection to be applied depending on a given level of risk. This saves the costs incurred on overprotection of an information asset. In baseline approach equal level of protection is applied for all information assets irrespective of asset value so as a result some assets could be under protective and some could be overprotective. Which testing method is most effective when doing the compliance testing? Attribute sampling Variable sampling Stratified mean per unit Difference estimation Ans. A Explanation Choice A is appropriate in this scenario. As attribute sampling model estimate the rate of occurrence of a specific quality in a population to confirm whether quality is present in compliance testing. The other means of sampling are used in substantive testing where details and quantity testing is done. Why email is considered a useful source of evidence in litigation in IS audit process? Wide use of email systems in enterprises as medium of communication Access control mechanisms to establish email communication accountability Backup and archiving of information flowing through email systems Data classification guidelines dictating information flow via email systems Ans. C Explanation Option C is most appropriate as archived/ backed up email files, may contain documents which have been deleted and could be recovered. Access controls only establish accountability but dont give evidence of the email. Data classification standardizes what to be communicated by email but dont provide information needed for litigation process. A post implementation review of an application is scheduled by IS auditor. What could be the possible situation which can hamper the independent assessment of IS auditor. Involved in the development of specific application and implemented specific functionality / control Integrated an embedded audit module in the application for auditing purpose Was member of application system project team but not involved at operational level Given advice on considering best practices while system was in development stage Ans. A Explanation Choice A is most appropriate in this scenario because the auditor independence is impaired in case he was involved actively during the development, acquisition and implementation of the new application. Choice B and C dont hamper auditor independence. And Choice D is not correct as auditor independence is not hampered by given advice on best known practices. What is the benefit of continuous audit approach: Collection of evidence is not required on system reliability during the processing stage Review and follow up on all information collected Improvement in overall security in time sharing environment where large number of transactions processed No dependency on complexity of organizations systems Ans. C Explanation Choice C is most appropriate w.r.t to continuous audit process major benefit as overall security is improved in time sharing environments where large number of transactions is processed but leaving insufficient trail of papers. Choice A is not correct as auditor need to collect evidence while processing is ON. Choice B is also not correct in this case as auditor does review and follows up on errors and material deficiency. Choice D is also incorrect as complexity of organization systems determines the use of continuous audit process technique. The objective of enabling audit trail is: Better response time for users Institute Accountability of processed transactions Improving operational efficiency of systems Better tracking of transactions to give useful information to auditors Ans. B Explanation Choice B is most appropriate in this scenario as accountability and responsibility can be established for processed transactions and tracing could be done end to end. Enabling audit trail dont improve user experience as it might involve additional processing which may impact user response time in other way. Choice D could also be considered valid but it is not the main reason for the purpose of enabling audit trails. In a risk based audit strategy, risk assessment is done by IS auditor to ensure: Risk mitigation controls are in place Threats and vulnerabilities are identified Risks related to audit are taken into consideration Gap analysis is done as per the need Ans. B Explanation Choice B is most appropriate in this scenario. Identification of threats and vulnerabilities is crucial in determining the scope of audit. Effect of an audit would be to develop controls to mitigate risks. Audit risks are not relevant to risk analysis of environment. Gap analysis compares the actual state to expected or desired state. A gap could be result of a risk not being correctly addressed or missed out. In order to achieve best value to organization in terms of audit resources we should : Do audit scheduling and measure the time spent on audits Training of audit staff on latest audit technologies Chalk out detailed plan based on risk assessment Progress monitoring of audits and have cost control measures in place Ans. C Explanation Choice C is most appropriate in this scenario. This will deliver value to organization in terms of dedicating resources on higher risk areas. Choice A, B and D will improve the staff productivity only. An IS audit charter includes: Plan for IS audit engagements Scope and objective of audit engagement Training plan for audit staff IS audit function role Ans. D Explanation Choice D is applicable in this scenario. Choice A is responsibility of audit management. Scope and objective is agreed on engagement letter and training of staff is again responsibility of audit management based on audit plan. In the evaluation of risk assessment of Information system. The IS auditor will first review: Controls in place Effectiveness of implemented controls Monitoring mechanism for risks related to assets Threats/ vulnerabilities impacting assets Ans. D Explanation Risks associated with using assets need to be evaluated first so choice D is most appropriate in this scenario. Controls effectiveness is part of risk mitigation stage and risk monitoring is part of risk monitoring function after risk assessment phase. During an audit plan, the most critical step is: High risk areas identification Skill set identification of audit team Identification of test steps in audit Identification of time allotted to audit Ans. A Explanation The choice A is appropriate in this scenario. The identification of high risk areas is most critical step as that will determine the areas to be focused during the audit. Skill set is determined before audit to begin. Test steps and time for audit is determined on the basis of areas to be audited. How much data to be collected during audit process will be determined on the basis of: Ease of obtaining the information records Familiarity with the environment to be audited Ease of obtaining the evidence Scope and purpose of audit Ans. D Explanation Scope and purpose will determine the amount of sample data to be collected during the audit. All other choices are irrelevant in this scenario as audit process is not hampered by ease of obtaining records or evidences or familiarity with the environment. During the audit plan, assessment of risk should provide: An assurance that audit will cover material items Material items would be covered definitely during the audit work Reasonable assurance that All items will be covered by audit work Assurance to suffice that all items will be covered during the audit work Ans. A Explanation Choice A. ISACA audit guideline G15 clearly states that An assessment of risk should be made to provide reasonable assurance that material items will be adequately covered during the audit work. Definite assurance clause in choice B is impractical, option C is also not correct as it states all items. Statistical sampling should be used by IS auditor and not judgmental sampling in the scenario: Objective quantification of error probability Avoidance of sampling risk by auditor General use audit software is available Unable to determine the tolerable error rate Ans. A Explanation With an expected error rate and confidence level, objective method of sampling is statistical in nature as it helps auditor to determine size of sample and quantify error probability or likelihood. Choice B is not correct because sampling risk is risk of sample. Choice C is also incorrect as statistical sampling doesnt need general software. Choice D is also incorrect because tolerable error rate is predetermined in statistical and judgmental sampling. The primary goal of an auditor during the IS audit planning stage is: Address audit objectives Sufficient evidence collection Mention appropriate tests Use less audit resources Ans. A Explanation As per ISACA guidelines auditor plan must address audit objectives. Choice B is not correct because evidence is not collected at planning stage. Choice C and D are also incorrect because they are not initial goals of audit plan. During an audit procedure selection, auditor will have to use professional judgment to ascertain: Sufficient evidence collection Identification of significant deficiencies and there correction in reasonable time period Material weakness identified Maintain minimal level of audit costs Ans. A Explanation Professional judgment during the course of an audit process involves subjective and qualitative evaluation of conditions. It is based more on past experience of auditor and auditor past experience plays a key role in this. Identification of material weaknesses is result of experience and planning thoroughness and also it does not deal with financial aspects of audit as stated in choice D. While evaluating logical access controls an auditor first: Documentation of controls applied to all possible access paths to system Testing of controls to access paths to determine they are functional Evaluation of security environment w.r.t. policies and procedures laid down Obtaining an understanding of security risks to information processing facilities Ans. D Explanation Choice D is most appropriate in this scenario. The first step is to gather security risks to information processing facilities, by studying documentation, inquiries and doing risk assessment. Documentation and evaluation is next step. Third step is to test access paths to ensure controls functionality. The last is auditor evaluation of security environment. The objective of forensic audit is to: Participation in investigations related to corporate fraud Evidence collection on systematic basis after system irregularity Assessment of correctness of organizations financial statements Determine if there was any criminal activity Ans. B Explanation Choice B is correct as evidence collection is used for juridical process. They are not only for corporate frauds. Financial statements correctness determination is not purpose of forensic audit. And criminal activity could be part of legal process but it is not the objective of forensic audit. An auditor is reviewing a backup log report of remote server backup. One of the entries in the backup log indicates failure to login to remote server for backup and there is no entry in log which confirms that backup was restarted. What IS auditor should do? Issue audit finding Explanation required from IS management Issue a non compliance Increase sample of logs to be reviewed Ans. D Explanation Choice D is appropriate in this case. Before issue audit finding or seeking explanation, or issue of non compliance auditor needs to gather additional evidence to properly evaluate the situation. For the purpose of auditing critical servers audit trail, auditor wants to use _______ tool to determine the potential irregularity in the user or system. CASE tools Embedded data collection tool Heuristics scanning tool Trend/variance detection tools Ans. D Explanation Trend/variance detection tools are used for determining the potential irregularity in the user or system. CASE tools are used in software development and embedded data collection tool is used for sample collection and Heuristics scanning tool used to detect virus infections. What could be the possible cause of great concern for an auditor while evaluating a corporate network for possible penetration from employees? Number of external modems connected to network Users have right to install software on there desktops Limited network monitoring or no monitoring at all User ids with identical passwords Ans. D Explanation Choice D is most appropriate in this scenario. It is the greatest threat. Choice A threat is there but depends on use of valid user id. In choice b likelihood is not high due to technical knowledge needed for penetration. Network monitoring is a means for detection. What is the major benefit of using computer forensic softwares in investigations? Preservation of electronic evidence Saving time and costs More efficient and effective Efficient search for violation of Intellectual property rights Ans. A Explanation The main purpose of forensic software is to preserve the chain of electronic evidence for investigation purpose. Others choice B and C are concerns to identify good / poor forensic software. Choice D is example of using forensic software. Data is imported from client database by auditor, now the next step is to confirm imported data is complete, what step need to be followed to verify the same. Match control total of imported data with original data Sort data to confirm data is in same order as the original data Review first 100 records of imported data with first 100 records of original data Category wise filtering of data and matching them to original data Ans. A Explanation The logical step in this scenario would be option A. this will confirm the completeness of process. Sorting may not be applicable in this scenario because original data may not be sorted order. Reviewing partial data does not suffice the purpose either. Filtering data would also need control totals to be established to ensure completeness of data. An audit is to be conducted to identify payroll overpayments in last year. Which audit technique would be best appropriate in this scenario? Data testing Use of general audit software Integrated test facility Embedded audit module Ans. B Explanation General auditing softwares include mathematical calculations, stratification, statistical analysis, sequence and duplicate checks and re-computations. So auditor can use appropriate tests to re-compute payroll data. Test data would not detect the anomalies and overpayments. Integrated test facility and embedded edit modules cannot detect previous errors. During an audit process, auditor finds out that security procedures are not documented what he should do? Auditor create procedure document Stop audit Do compliance testing Evaluate and identify exiting practices being followed Ans. D Explanation The purpose of audit is to identify risks, so the most appropriate approach would be identify and evaluate current practices being followed. Auditors dont create documentation, compliance testing cannot be done as no document is there and stopping audit will jeopardize the objective of audit i.e. risks identification. Threats and their potential impacts are identified during the course of an risk analysis stage what should be next most appropriate step? Identification and assessment of risk assessment approach of management Identification of all information assets and systems Disclosure of threats and impacts to management Identification and evaluation of existing controls Ans. D Explanation The next step would be choice D. once the threats and impacts are identified. Next step is to share them with management. Out of the following which one is the most significant concern for an auditor? Non reporting of network attack Notification failure to police of an attempted intrusion Periodic review of access rights not present No notification of intrusion to public Ans. A Explanation Failure to report a network attack is major cause of concern. Reporting to public is organization choice and notification to police is also matter of choice. Periodic examination of access rights could be causing of concern but not as big as option A. Which is the most dependable evidence for an auditor out of the following: Letter from 3rd party on compliance Line management assurance that application is performing as per design Information obtained from www Reports supplied by organization management to auditor Ans. A Explanation The most reliable evidence is the one given by external party. Choice B, C and D are not considered reliable. While evaluating a process on the basis of preventive, detective and corrective controls, an IS auditor should know? The point at which controls used as data flow through system Preventive and detectives controls are only relevant ones Corrective controls are only relevant Classification is required to determine which controls are absent Ans. A Explanation Choice A is most appropriate. Choice B and C are incorrect as all controls are important. Choice D is also not correct because functioning of controls is important and not its classification. The best evidence of duties segregation is identified by using ____ audit technique? Discussions with management Organization chart review Interviews and observations User access rights testing Ans. C Explanation Based on choice C an auditor can evaluate the duties segregation. Management may not be aware of detailed functioning, organization chart only depicts hierarchy of reporting, and testing will only tell user rights but will not give any details on function being performed by users. While reviewing a customer master file, auditor discovers that many customer names are appearing in duplicate causing variation in customer first names. How auditor will determine the amount of duplication in this scenario? Testing data to validate input Testing data to check sorting capabilities Use general audit software to detect address field duplications Use general audit software to detect account field duplications Ans. C Explanation As names are not same, so we need to use some other field to determine duplication such as address field. Test data will not help in this case and searching on account number may not yield desired result because customers could have different account numbers for each entry. While testing for program changes what is the best population to choose sample from? Library listings testing Listing of source programs Change request programs Listing of production library Ans. D Explanation The best source to draw sample or test system is automated system. Choice B would be time consuming. Program change request are initial documents to initiate changes; test libraries dont present approved and authorized executables. An integrated test facility is an efficient tool for audit: Audit of application control in a cost effective manner Integrating audit tests for financial and IS auditors Comparison of processing output with independently calculated data Tool to analyze large range of information Ans. C Explanation It is a useful audit tool because it uses similar program to compare processing with independently calculated data. This involves setting up dummy entities and processing test/production data. IS auditors use data flow diagrams to: Hierarchical ordering of data Highlighting high level data definitions Summarize data paths and storage in graphical manner Step by step details of data generation portrait Ans. C Explanation Data flow diagrams are used to chart flow of data and storage. They dont order data in hierarchical manner. Data flow not necessarily match hierarchy or order of data generation. Review of organization chart is done by auditor to: Understand workflows Identify all communication channels Responsibility and authority of individuals Network diagram connected to different employees Ans. C Explanation Organization chart always depicts the responsibility and authority of individuals in an organization. This is required to understand the segregation of functions. While performing an audit of network operating system, an auditor should review the following user feature? Network document availability online Support for terminal access to remote systems File transfer handling between users and hosts Audit, control and performance management Ans. A Explanation Network operating system user features comprise online availability of network documentation. Choice B, C and D are some examples of network OS functions. In order to ascertain that access to program documentation is only restricted to authorize users, an auditor should check: Evaluation of retention plan for off site storage Procedures being followed by programmers Comparison of utilization records to operational schedule Review data access records Ans. B Explanation Interview of programmers to understand procedures being followed is the best way to ascertain the access to program documentation is only with authorized personnel. Off site storage, utilization records and review of data access records will not address security of program documentation. Auditor is evaluating an application which does computation of payments. During the audit it is reveled that 50% of calculation is not matching with the set total. What should be the next step auditor need to follow as part of audit practice? Do further test on calculations having error Identification of variables that generated inaccurate test results Testify some more test cases to reconfirm the anomaly Documentation of results, findings, conclusions and recommendations Ans. C Explanation Auditor needs to examine some more test cases where incorrect calculations happened and then confirm with the final outcome. Once calculations are complete further tests can be performed and then report to be made only after confirmation and not before that. In order to prove the correctness of system tax calculation the best practice to be followed is: In depth review and analysis of source code Using general auditing software to recreate program logic for monthly totals calculation Simulate transactions for results comparison In depth analysis and flow chart preparation of the source code Ans. C Explanation The best way to prove accuracy of tax calculation is simulation of transactions. Detailed review, flow chart and analysis of source code will not be effective and monthly total will not confirm the correctness of tax calculations at individual level. In Applications control review , auditor must analyze : Application efficiency in meeting business processes Exposures impact Business processes performed by application Optimization of application Ans. B Explanation Application control review requires analysis of application automated controls and analysis of exposures due to controls weaknesses. The other options could be objective of audit but not specifically meant to analyze application controls. What is the most accurate evidence to prove that purchase orders are legitimate while auditing an inventory application? Application parameters can be modified by unauthorized personnel Purchase order tracing Comparison of receiving reports to purchase order details Application documentation review Ans. A Explanation Access control testing is the best way to determine purchase orders legitimacy and is the best evidence. Choice B and C are part of further actions and choice D will not serve the purpose as application documentation process and actual process could vary. Irregularities at an early stage can be detected in the best manner by using ______ online auditing technique. Embedded audit module Integrated test facility Snapshots Audit books Ans. D Explanation The audit book technique also involves embedding code in applications to reveal early detection of irregularity. Embedded audit module is used for monitoring application systems on select