CISA IS Audit Planning 2 — Questions and Answers
Question 1: During IS audit planning, which document formally authorizes the audit and defines its scope, objectives, and resources?
- Audit charter
- Engagement letter (Correct answer)
- Audit program
- Risk register
Correct answer: Engagement letter
The engagement letter (or audit engagement letter) formally authorizes the audit and outlines scope, objectives, timing, and resource requirements agreed upon between the auditor and management.
Question 2: When planning an IS audit, an auditor discovers that the organization recently experienced a major system migration. How should this affect the audit plan?
- Postpone the audit until the system stabilizes
- Increase audit scope to cover migration risks and residual vulnerabilities (Correct answer)
- Reduce scope since new systems have fewer legacy issues
- Focus only on pre-migration controls
Correct answer: Increase audit scope to cover migration risks and residual vulnerabilities
A recent system migration increases inherent risk and should prompt the auditor to expand scope to cover migration-related risks, data integrity issues, and control gaps.
Question 3: Which sampling technique is most appropriate when an IS auditor wants every item in the population to have an equal chance of selection?
- Judgmental sampling
- Stratified sampling
- Simple random sampling (Correct answer)
- Cluster sampling
Correct answer: Simple random sampling
Simple random sampling gives every item in the population an equal and independent probability of being selected, eliminating selection bias.
Question 4: An IS auditor is planning a review of access controls. The PRIMARY reason for performing a preliminary survey is to:
- Identify all control deficiencies before fieldwork begins
- Obtain sufficient understanding of the environment to develop audit procedures (Correct answer)
- Replace the need for detailed testing of controls
- Document findings for the audit report
Correct answer: Obtain sufficient understanding of the environment to develop audit procedures
A preliminary survey provides the auditor with enough understanding of the systems, processes, and environment to design appropriate and targeted audit procedures.
Question 5: In IS audit planning, materiality is BEST defined as:
- The dollar threshold above which errors must be reported
- The significance of a matter in the context of the audit objectives and stakeholder decision-making (Correct answer)
- The minimum number of control failures that trigger a finding
- The risk level assigned to a specific audit area
Correct answer: The significance of a matter in the context of the audit objectives and stakeholder decision-making
Materiality refers to the significance or importance of information, errors, or omissions in the context of the financial statements or audit objectives that could influence stakeholder decisions.
Question 6: When assessing inherent risk during IS audit planning, the auditor should consider:
- The effectiveness of existing controls
- The risk that exists independent of any controls (Correct answer)
- Management's response to prior audit findings
- The cost of implementing additional controls
Correct answer: The risk that exists independent of any controls
Inherent risk is the susceptibility of an assertion or area to a material misstatement or error assuming no related controls exist.
Question 7: Which of the following BEST describes the purpose of an audit program in IS audit planning?
- A high-level document authorizing the audit function
- A set of detailed instructions guiding the auditor through specific procedures to achieve audit objectives (Correct answer)
- A summary of findings presented to management
- A schedule of all audits planned for the year
Correct answer: A set of detailed instructions guiding the auditor through specific procedures to achieve audit objectives
An audit program is a detailed set of procedures and instructions that guide the auditor in gathering sufficient evidence to meet the specific objectives of the audit.
CISA IS Audit Planning 2
During IS audit planning, which document formally authorizes the audit and defines its scope, objectives, and resources?