Audit Management Flashcards
7 cards from real CCISO practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Audit Management flashcards as text
Which audit sampling method selects items based on their monetary value, giving higher-value transactions a greater probability of selection?
Answer: Monetary unit sampling
Monetary unit sampling (MUS) gives each dollar an equal probability of selection, so higher-value items are more likely to be chosen.
A CISO discovers that an internal audit team lacks independence because its manager reports to the CIO. What is the most appropriate corrective action?
Answer: Restructure so the internal audit function reports to the audit committee or board
True independence requires the internal audit function to report to the audit committee or board, not to operational management.
During a closing meeting, the auditee disputes a finding. What is the auditor's best response?
Answer: Document the dispute and include management's response in the final report
Documenting the dispute and including management's rebuttal preserves objectivity and provides a complete record in the final report.
Which document formally authorizes an audit engagement and defines its scope, objectives, and resources?
Answer: Engagement letter
The engagement letter (or audit plan) formally authorizes a specific audit, defining scope, objectives, timeline, and resource allocation.
An audit reveals that compensating controls exist where a primary control has failed. How should the CISO treat residual risk in this scenario?
Answer: Evaluate whether the compensating controls sufficiently reduce residual risk to an acceptable level
Compensating controls must be evaluated to confirm they adequately reduce residual risk before accepting the current state.
In audit terminology, what does 'materiality' determine?
Answer: The threshold above which misstatements or control gaps are significant enough to report
Materiality is the threshold at which a misstatement or deficiency is significant enough to affect decisions or require reporting.
Which phase of the audit lifecycle produces the audit work program used to guide fieldwork?
Answer: Planning phase
The planning phase produces the audit work program, which outlines the procedures, tests, and steps auditors will execute during fieldwork.