IS Audit Planning Flashcards
7 cards from real CISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 IS Audit Planning flashcards as text
During IS audit planning, which document formally authorizes the audit and defines its scope, objectives, and resources?
Answer: Engagement letter
The engagement letter (or audit engagement letter) formally authorizes the audit and outlines scope, objectives, timing, and resource requirements agreed upon between the auditor and management.
When planning an IS audit, an auditor discovers that the organization recently experienced a major system migration. How should this affect the audit plan?
Answer: Increase audit scope to cover migration risks and residual vulnerabilities
A recent system migration increases inherent risk and should prompt the auditor to expand scope to cover migration-related risks, data integrity issues, and control gaps.
Which sampling technique is most appropriate when an IS auditor wants every item in the population to have an equal chance of selection?
Answer: Simple random sampling
Simple random sampling gives every item in the population an equal and independent probability of being selected, eliminating selection bias.
An IS auditor is planning a review of access controls. The PRIMARY reason for performing a preliminary survey is to:
Answer: Obtain sufficient understanding of the environment to develop audit procedures
A preliminary survey provides the auditor with enough understanding of the systems, processes, and environment to design appropriate and targeted audit procedures.
In IS audit planning, materiality is BEST defined as:
Answer: The significance of a matter in the context of the audit objectives and stakeholder decision-making
Materiality refers to the significance or importance of information, errors, or omissions in the context of the financial statements or audit objectives that could influence stakeholder decisions.
When assessing inherent risk during IS audit planning, the auditor should consider:
Answer: The risk that exists independent of any controls
Inherent risk is the susceptibility of an assertion or area to a material misstatement or error assuming no related controls exist.
Which of the following BEST describes the purpose of an audit program in IS audit planning?
Answer: A set of detailed instructions guiding the auditor through specific procedures to achieve audit objectives
An audit program is a detailed set of procedures and instructions that guide the auditor in gathering sufficient evidence to meet the specific objectives of the audit.