CISA Certified Information Systems Auditor 2

Question 1

During an IS audit, an auditor discovers that a control is functioning as intended but the risk it mitigates has already been accepted by management. What is the BEST course of action?

Accepted Answer

Document the accepted risk and note the control as redundant in the report

Answer

Auditors should document management-accepted risks and flag controls that may be redundant relative to the risk posture.

Question 2

Which of the following BEST describes the purpose of a control self-assessment (CSA)?

Accepted Answer

To allow management and staff to assess controls collaboratively

Answer

CSA is a technique where management and staff work together to assess the effectiveness of controls in their own areas.

Question 3

An organization uses a third-party cloud provider for critical data processing. Which audit approach is MOST appropriate to assess the provider's controls?

Accepted Answer

Obtain and evaluate a SOC 2 Type II report

Answer

A SOC 2 Type II report provides an independent assessment of a service organization's controls over a period of time.

Question 4

When evaluating IT governance, an IS auditor should PRIMARILY focus on whether:

Accepted Answer

IT strategy is aligned with business objectives

Answer

IT governance ensures that IT investments and strategies are aligned with and support overall business objectives.

Question 5

A residual risk is BEST defined as:

Accepted Answer

Risk that remains after controls have been applied

Answer

Residual risk is the level of risk remaining after management has implemented controls and other risk responses.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA Certified Information Systems Auditor 2