CISA Exam - Practice Exam CHP 01

Practice Questions 1.

A1:

2.

A2:

3.

A3:

4.

If an organization chooses to implement a control self-assessment program, the auditor should participate primarily as a: □

A. Monit or

□

B.  ac ilit at or

□

!. Pro"ec t le leader

□

#. $he aud audiitor shou shoulld not not par participate ticipate in in the or organi ganizati zation on%%s !&A program 'ecause doing so (ould create a potential conflict of interest.

Ans(er: B. $he traditional role of an I& auditor in a control self-assessment )!&A* should 'e that of a facilitator. +hich of the follo(ing elements must 'e present to properly log actiities and achiee accounta'ility for actions performed 'y a user □

A. Identi entifi ficati cation on and and auth author oriizati zation on on onlly

□

B. Au Auth then enti ticati cation on and and au author thoriization ation on onlly

□

!. Identi entifi ficati cation on and and au authen thenti ticati cation on on onlly

□

#. Aut ho horizat io ion only

Ans(er: !. If proper identification and authentication are not performed during access control, no accounta'ility can eist for any action performed. +hen initially planning a ris/-'ased ris/-'ased audit, (hich of the follo(ing steps is M0&$ critical □

A. 1al 1alua uatin ting g the the orga organi nizati zation on%%s entir entire e eni enirron onm ment ent as a (hole

□

B. 1sta' 1sta'llishi shing an audi auditt meth method odol olog ogy y 'ase 'ased d on on acc acc epted epted frame(or/s, such as !0 BI $ or !0&0

□

!. #ocumenti entin ng pr procedur ocedures es to en ensur sure that that the au auditor ditor ac hiees hiees the planned planned audit audit o'"ect ies

□

#. $he ide identi ntifi fication cation of the the areas areas of hi high ris/ for control controls s failure

Ans(er: #. In planning an audit, the M0&$ critical step is identifying areas of high ris/. ris/.

+hat is the P2IMA23 P2IMA23 purpose of audit trails

A4:

5.

A5: 6.

A6:

7.

□

A. $o 'etter ealuate and correct audit ris/ resulting from potential errors the auditor might hae committed 'y failing to detec t controls failure

□

B. $o esta'lish a chronological chain of eents for audit (or/ performed

□

!. $o esta'lish acc ounta'ility and responsi'ility for processed transactions

□

#. $o compensate for a lac/ of proper segregation of duties

Ans(er: !. Although secure audit trails and other logging are used as a compensatory control for a lac/ of proper segregation of duties, the primary purpose of audit trails is to esta'lish accounta'ility and responsi'ility for processed transactions. +hich of the follo(ing is the M0&$ appropriate type of ris/ to 'e associated (ith authorized program eits )trap doors* □

A. Inherent

□

B. Audit

□

!. #etec tion

□

#. Business

Ans(er: A. Inherent ris/ is associated (ith authorized program eits )trap doors*. +hen performing an audit of an organization%s systems, the auditor%s first step should 'e to: □

A. #eelop a strategic audit plan

□

B. 4ain an understanding of the focus of the 'usiness of the organization

□

!. Perform an initial ris/ assessment t o proide the foundation for a ris/-'ased audit

□

#. #etermine and define audit scope and materiality

Ans(er: B. $he I& auditor%s first step is to understand the 'usiness focus of the organization. 5ntil the auditor has a good understanding of the organization%s 'usiness goals, o'"ecties, and operations, the auditor (ill not 'e a'le to competently complete any of the other tas/s listed. +hich of the follo(ing ris/s results (hen the auditor uses an insufficient test procedure, resulting in the auditor%s ill-informed c onclusion that material errors do not eist, (hen, in fact, they do

A7:

8.

A8:

9.

□

A. Business ris/

□

B. #etec tion ris/

□

!. Audit ris/

□

#. Inherent ris/

Ans(er: B. #etection ris/ results (hen an I& auditor uses an inade6uate test procedure and concludes that material errors do not eist (hen, in fact, they do. +hich of the follo(ing is considered the M0&$ significant adantage of implementing a continuous auditing approach □

A. It can improe system security (hen used in time-sharing enironments that process a large num'er of transactions.

□

B. It c an proide more actiona'le audit results 'ecause of  the increased input from management and staff.

□

!. It can identify high-ris/ areas that might need a detailed reie( later.

□

#. It c an significantly reduce the amount of resources necessary for performing the audit 'ecause time c onstraints are more relaed.

Ans(er: A. $ he P2IMA23 adantage of a c ontinuous audit approac h is t hat it can improe system security (hen used in time-sharing enironments that process a large num'er of transactions. +hen an I& auditor finds eidence of minor (ea/nesses in controls, such as use of  (ea/ pass(ords, or poor monitoring of reports, (hich of the follo(ing courses of  action is M0&$ appropriate for the auditor □

A. $a/e correctie action 'y informing affected users and management of the controls ulnera'ilities

□

B. 2ealize that such minor (ea/nesses of controls are usually not material to the audit

□

!. Immediately report such (ea/nesses to I$ management

□

#. $a/e no correctie action (hatsoeer, and simply record the o'serations and associated ris/ arising from the c ollec tie (ea/nesses into t he audit report

A9:

Ans(er: #. +hile preparing the audit report, the I& auditor should record the o'serations and the ris/ arising from the collectie (ea/nesses.

10.

+hich of the follo(ing is considered to present the 421A$1&$ challenge to using test data for alidating processing

A10:

□

A. Potential corruption of actual lie data

□

B. !reation of test data that c oers all possi'le alid and inalid conditions

□

!. $est results 'eing compared to epected results from lie processing

□

#. #ata isolation issues associated (ith high-speed transact ion processing

Ans(er: B. !reating test data that coers all possi'le alid and inalid conditions is often the greatest challenge in using test data.