CISA IS Audit Planning 4 — Questions and Answers
Question 1: An IS auditor notices that a key IT system has not been audited in three years. According to risk-based planning, this fact PRIMARILY affects which planning element?
- Detection risk
- Residual risk
- Audit frequency prioritization (Correct answer)
- Control risk assessment
Correct answer: Audit frequency prioritization
A long gap since the last audit increases the priority of that system in audit frequency planning, as unaudited areas may have accumulated undetected risks.
Question 2: During IS audit planning, which of the following is the BEST source for understanding an organization's IT risk posture?
- Prior year's financial statements
- The organization's enterprise risk management (ERM) framework and IT risk register (Correct answer)
- Vendor documentation for installed software
- Industry benchmarking reports
Correct answer: The organization's enterprise risk management (ERM) framework and IT risk register
The ERM framework and IT risk register document the organization's identified risks, their likelihood and impact, and existing mitigations — making them the primary source for risk-based audit planning.
Question 3: An IS auditor is planning an audit and must evaluate whether to use Computer-Assisted Audit Techniques (CAATs). The PRIMARY advantage of CAATs is:
- They eliminate the need for auditor judgment
- They enable analysis of entire data populations rather than just samples (Correct answer)
- They reduce the need for interviewing auditees
- They ensure 100% accuracy of audit findings
Correct answer: They enable analysis of entire data populations rather than just samples
CAATs allow auditors to analyze complete data populations rather than relying on samples, providing greater coverage and statistical confidence in findings.
Question 4: When planning an IS audit for a regulated financial institution, which external requirement should MOST influence the audit plan?
- The organization's internal IT strategy document
- Applicable regulatory requirements and compliance mandates (e.g., FFIEC, SOX) (Correct answer)
- Competitor audit practices
- The IT vendor's recommended audit procedures
Correct answer: Applicable regulatory requirements and compliance mandates (e.g., FFIEC, SOX)
Regulatory requirements define mandatory compliance areas that must be covered in the audit plan, taking precedence over internal preferences or vendor guidance.
Question 5: Which of the following BEST describes the relationship between audit objectives and audit procedures in IS audit planning?
- Audit procedures define the objectives the auditor wants to achieve
- Audit objectives drive the design of audit procedures used to gather evidence (Correct answer)
- Audit procedures and objectives are developed independently
- Audit objectives are set by the auditee, not the auditor
Correct answer: Audit objectives drive the design of audit procedures used to gather evidence
Audit objectives define what the auditor seeks to determine, and audit procedures are then designed specifically to gather the evidence needed to meet those objectives.
Question 6: During IS audit planning, an auditor reviews organizational charts and job descriptions. The PRIMARY purpose is to:
- Identify potential fraud perpetrators
- Understand segregation of duties and the assignment of IT responsibilities (Correct answer)
- Evaluate employee performance
- Determine headcount for staffing risk assessment
Correct answer: Understand segregation of duties and the assignment of IT responsibilities
Reviewing organizational charts and job descriptions helps the auditor understand how IT responsibilities are assigned and whether proper segregation of duties exists.
Question 7: An IS auditor concludes that the planned audit cannot be completed within budget due to expanded scope. The auditor should FIRST:
- Reduce testing in low-risk areas to compensate
- Inform management and obtain approval for additional resources or a revised scope (Correct answer)
- Issue a qualified audit opinion due to resource constraints
- Carry over remaining work to the next audit cycle without disclosure
Correct answer: Inform management and obtain approval for additional resources or a revised scope
When audit constraints arise, the auditor must communicate transparently with management to either secure additional resources or formally revise the scope through proper approval.
CISA IS Audit Planning 4
An IS auditor notices that a key IT system has not been audited in three years.
According to risk-based planning, this fact PRIMARILY affects which planning element?