CISA IS Audit Planning 3 — Questions and Answers
Question 1: An IS auditor is planning an audit of a cloud-hosted ERP system. Which consideration is UNIQUE to cloud environments compared to on-premises systems?
- Need to evaluate user access controls
- Reliance on third-party audits such as SOC 2 reports to assess provider controls (Correct answer)
- Requirement to review change management procedures
- Importance of evaluating backup and recovery processes
Correct answer: Reliance on third-party audits such as SOC 2 reports to assess provider controls
In cloud environments, the auditor typically cannot directly test provider infrastructure controls and must rely on third-party assurance reports like SOC 2 Type II to evaluate those controls.
Question 2: During IS audit planning, the concept of 'audit universe' refers to:
- All potential risks identified across the organization
- The complete inventory of auditable entities from which the audit plan is derived (Correct answer)
- The total number of staff available for audit work
- The set of regulatory requirements applicable to the organization
Correct answer: The complete inventory of auditable entities from which the audit plan is derived
The audit universe is the comprehensive inventory of all auditable entities — systems, processes, departments — that forms the basis for developing a risk-based audit plan.
Question 3: When should IS audit planning ideally begin relative to the audit fieldwork?
- Immediately before fieldwork starts
- Well in advance to allow adequate preparation, risk assessment, and resource allocation (Correct answer)
- After preliminary interviews with management are complete
- Only after the prior audit's findings are remediated
Correct answer: Well in advance to allow adequate preparation, risk assessment, and resource allocation
Planning should begin well in advance of fieldwork to allow time for risk assessment, scoping, resource scheduling, and coordination with auditees.
Question 4: Which factor would MOST likely cause an IS auditor to increase the sample size during audit planning?
- Low population size
- High control risk (Correct answer)
- Low inherent risk
- Strong prior audit results
Correct answer: High control risk
High control risk means existing controls may not be effective, so the auditor needs a larger sample to gain sufficient confidence in the audit conclusions.
Question 5: An IS auditor planning an audit of the software development lifecycle (SDLC) should PRIMARILY focus on which phase for the highest control risk?
- Testing phase
- Requirements gathering phase
- Production deployment phase (Correct answer)
- Maintenance phase
Correct answer: Production deployment phase
Production deployment is the highest-risk SDLC phase because unauthorized or untested code moving to production can directly impact business operations and data integrity.
Question 6: In the context of IS audit planning, 'scope creep' refers to:
- Gradual expansion of audit scope beyond what was originally agreed, without corresponding adjustment of resources or timelines (Correct answer)
- The process of narrowing scope to focus on high-risk areas
- Additional testing required when control deficiencies are found
- Expanding the audit team mid-engagement
Correct answer: Gradual expansion of audit scope beyond what was originally agreed, without corresponding adjustment of resources or timelines
Scope creep occurs when the audit scope expands incrementally beyond original boundaries without formal approval, potentially compromising audit quality and resource management.
Question 7: Which of the following BEST describes a risk-based audit approach in IS audit planning?
- Auditing every system and process equally regardless of risk level
- Allocating audit resources to areas with the highest risk to achieve audit objectives efficiently (Correct answer)
- Focusing only on financial systems because they pose the most regulatory risk
- Following a fixed template that does not change between audit cycles
Correct answer: Allocating audit resources to areas with the highest risk to achieve audit objectives efficiently
A risk-based approach directs audit resources toward the areas posing the greatest risk, ensuring that audit effort is proportionate to the likelihood and impact of potential issues.
CISA IS Audit Planning 3
An IS auditor is planning an audit of a cloud-hosted ERP system.
Which consideration is UNIQUE to cloud environments compared to on-premises systems?