CISA IS Audit Planning 5 — Questions and Answers
Question 1: An IS auditor is planning an audit of an organization that recently implemented an AI-based fraud detection system. Which audit area deserves the MOST attention in the initial planning phase?
- Physical security of AI servers
- Algorithm bias, model validation, and governance of AI decision-making (Correct answer)
- Number of fraud alerts generated daily
- Vendor support contract terms
Correct answer: Algorithm bias, model validation, and governance of AI decision-making
AI systems introduce risks around model accuracy, bias, and lack of explainability, making algorithm validation and governance the most critical areas for an IS auditor to plan around.
Question 2: Which of the following scenarios BEST illustrates an inappropriate restriction on audit scope that an IS auditor should escalate?
- Management requests the auditor avoid reviewing a specific high-risk system due to 'sensitivity' (Correct answer)
- Management provides a list of recommended contacts for interviews
- The audit committee requests a focus on cybersecurity controls
- Management asks for a preliminary briefing before the audit report is finalized
Correct answer: Management requests the auditor avoid reviewing a specific high-risk system due to 'sensitivity'
When management restricts access to a high-risk area without valid justification, it represents a scope limitation that must be escalated to the audit committee as it impairs audit independence.
Question 3: During IS audit planning, the auditor reviews prior audit workpapers. The PRIMARY benefit of this review is to:
- Copy prior procedures to save planning time
- Understand previously identified risks, findings, and remediation status to inform current planning (Correct answer)
- Avoid duplication by skipping areas already tested
- Confirm that prior auditors used appropriate methodologies
Correct answer: Understand previously identified risks, findings, and remediation status to inform current planning
Reviewing prior workpapers helps identify historical risk areas, outstanding findings, and whether remediation was completed, all of which inform current audit risk assessment and focus.
Question 4: Which IS audit planning concept ensures that audit conclusions are supported by sufficient, reliable, relevant, and useful evidence?
- Audit materiality
- Audit evidence standards (Correct answer)
- Audit independence
- Audit risk model
Correct answer: Audit evidence standards
Audit evidence standards require that the evidence gathered be sufficient (enough), reliable (trustworthy), relevant (pertinent to the objective), and useful (supportive of conclusions).
Question 5: An IS auditor plans to rely on the work of an internal audit team. Which condition MUST be assessed before placing reliance on their work?
- Whether the internal audit team reports to the CFO
- The competence and objectivity of the internal audit function (Correct answer)
- Whether internal auditors use the same tools as external auditors
- The number of years the internal audit team has been in place
Correct answer: The competence and objectivity of the internal audit function
Before relying on internal audit work, an IS auditor must evaluate the internal audit team's technical competence and organizational objectivity to ensure their work meets adequate standards.
Question 6: In IS audit planning, which approach helps an auditor identify control gaps by mapping risks to existing controls?
- Flowcharting
- Control matrix (risk-control matrix) (Correct answer)
- Data flow diagramming
- Entity-relationship diagramming
Correct answer: Control matrix (risk-control matrix)
A risk-control matrix maps identified risks to the controls designed to mitigate them, making it easy to spot areas where controls are absent, weak, or duplicated.
Question 7: An IS auditor is planning an audit in an environment where management has implemented continuous monitoring tools. The auditor should PRIMARILY:
- Rely entirely on continuous monitoring results and skip independent testing
- Evaluate the design and effectiveness of the continuous monitoring tools as part of the audit plan (Correct answer)
- Assume controls are effective since continuous monitoring is in place
- Replace audit sampling with management's monitoring reports
Correct answer: Evaluate the design and effectiveness of the continuous monitoring tools as part of the audit plan
The auditor must assess whether the continuous monitoring tools themselves are properly designed and operating effectively before placing any reliance on their output.
CISA IS Audit Planning 5
An IS auditor is planning an audit of an organization that recently implemented an AI-based fraud detection system.
Which audit area deserves the MOST attention in the initial planning phase?