CCISO Audit Management 2 — Questions and Answers
Question 1: Which audit sampling method selects items based on their monetary value, giving higher-value transactions a greater probability of selection?
- Systematic sampling
- Monetary unit sampling (Correct answer)
- Stratified random sampling
- Judgment sampling
Correct answer: Monetary unit sampling
Monetary unit sampling (MUS) gives each dollar an equal probability of selection, so higher-value items are more likely to be chosen.
Question 2: A CISO discovers that an internal audit team lacks independence because its manager reports to the CIO. What is the most appropriate corrective action?
- Outsource all audits to an external firm
- Restructure so the internal audit function reports to the audit committee or board (Correct answer)
- Rotate audit staff annually to reduce bias
- Require auditors to sign independence declarations
Correct answer: Restructure so the internal audit function reports to the audit committee or board
True independence requires the internal audit function to report to the audit committee or board, not to operational management.
Question 3: During a closing meeting, the auditee disputes a finding. What is the auditor's best response?
- Remove the finding to maintain the relationship
- Document the dispute and include management's response in the final report (Correct answer)
- Escalate immediately to legal counsel
- Defer the finding to the next audit cycle
Correct answer: Document the dispute and include management's response in the final report
Documenting the dispute and including management's rebuttal preserves objectivity and provides a complete record in the final report.
Question 4: Which document formally authorizes an audit engagement and defines its scope, objectives, and resources?
- Audit work program
- Audit charter
- Engagement letter (Correct answer)
- Risk register
Correct answer: Engagement letter
The engagement letter (or audit plan) formally authorizes a specific audit, defining scope, objectives, timeline, and resource allocation.
Question 5: An audit reveals that compensating controls exist where a primary control has failed. How should the CISO treat residual risk in this scenario?
- Accept residual risk without further action because compensating controls exist
- Evaluate whether the compensating controls sufficiently reduce residual risk to an acceptable level (Correct answer)
- Immediately escalate to the board as a critical finding
- Require full remediation of the primary control regardless of compensating controls
Correct answer: Evaluate whether the compensating controls sufficiently reduce residual risk to an acceptable level
Compensating controls must be evaluated to confirm they adequately reduce residual risk before accepting the current state.
Question 6: In audit terminology, what does 'materiality' determine?
- The legal admissibility of audit evidence
- The threshold above which misstatements or control gaps are significant enough to report (Correct answer)
- The number of sample items required for statistical validity
- The classification level of audit working papers
Correct answer: The threshold above which misstatements or control gaps are significant enough to report
Materiality is the threshold at which a misstatement or deficiency is significant enough to affect decisions or require reporting.
Question 7: Which phase of the audit lifecycle produces the audit work program used to guide fieldwork?
- Reporting phase
- Planning phase (Correct answer)
- Follow-up phase
- Evidence evaluation phase
Correct answer: Planning phase
The planning phase produces the audit work program, which outlines the procedures, tests, and steps auditors will execute during fieldwork.
CCISO Audit Management 2
Which audit sampling method selects items based on their monetary value, giving higher-value transactions a greater probability of selection?