ISACA Information System Auditing Process 3 ā Questions and Answers
Question 1: During an IT general controls audit, which area would an IS auditor focus on to assess whether program changes are authorized and tested before moving to production?
- Logical access controls
- Change management controls (Correct answer)
- Physical security controls
- Backup and recovery controls
Correct answer: Change management controls
Change management controls govern the authorization, testing, and migration of program changes from development to production environments.
Question 2: What does 'audit universe' refer to in internal audit planning?
- The total number of auditors available in the department
- All auditable entities or activities within an organization (Correct answer)
- The complete set of audit standards applicable to an organization
- All external regulations an organization must comply with
Correct answer: All auditable entities or activities within an organization
The audit universe comprises all auditable entitiesāprocesses, systems, departmentsāfrom which the audit plan is derived based on risk assessment.
Question 3: An IS auditor uses Computer-Assisted Audit Techniques (CAATs) to analyze an entire population of transactions. This approach is PRIMARILY beneficial because it:
- Eliminates the need for audit documentation
- Allows 100% coverage of transactions, reducing sampling risk (Correct answer)
- Replaces the need for auditor judgment
- Reduces the time spent on audit planning
Correct answer: Allows 100% coverage of transactions, reducing sampling risk
CAATs enable auditors to analyze complete data populations rather than samples, eliminating sampling risk and increasing audit coverage.
Question 4: Which of the following BEST describes 'inherent risk' in the context of IS auditing?
- The risk that remains after management has applied controls
- The risk that the auditor's procedures will fail to detect errors
- The susceptibility of an area to a material misstatement assuming no controls (Correct answer)
- The combined risk of a material error occurring and not being detected
Correct answer: The susceptibility of an area to a material misstatement assuming no controls
Inherent risk is the level of risk present in the absence of any mitigating controlsāthe raw, uncontrolled risk of an area.
Question 5: When reviewing Business Continuity Planning (BCP), an IS auditor should PRIMARILY assess whether:
- The BCP document has been printed and distributed to all staff
- Recovery procedures have been tested and meet recovery time objectives (Correct answer)
- The IT department wrote the plan without business input
- All servers have been replaced within the last three years
Correct answer: Recovery procedures have been tested and meet recovery time objectives
The most critical BCP control is that recovery procedures are regularly tested and validated against documented Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Question 6: An IS auditor reviews system logs and identifies repeated failed login attempts on a privileged account followed by a successful login. This MOST likely indicates:
- A software bug in the authentication module
- A potential brute-force attack resulting in unauthorized access (Correct answer)
- Normal user behavior during a password reset
- Routine system maintenance activities
Correct answer: A potential brute-force attack resulting in unauthorized access
Repeated failed logins followed by success on a privileged account is a classic indicator of a brute-force or credential-stuffing attack.
Question 7: Which phase of the IS audit process involves comparing actual results against expected criteria to identify exceptions?
- Audit planning
- Fieldwork and evidence gathering (Correct answer)
- Reporting
- Follow-up
Correct answer: Fieldwork and evidence gathering
During fieldwork, auditors execute audit proceduresātesting, observing, and comparing evidence against defined audit criteria to identify deviations.
ISACA Information System Auditing Process 3
During an IT general controls audit, which area would an IS auditor focus on to assess whether program changes are authorized and tested before moving to production?