CISA IS Audit Planning 3

Question 1

An IS auditor is planning an audit of a cloud-hosted ERP system. Which consideration is UNIQUE to cloud environments compared to on-premises systems?

Accepted Answer

Reliance on third-party audits such as SOC 2 reports to assess provider controls

Answer

Need to evaluate user access controls

Answer

Requirement to review change management procedures

Answer

Importance of evaluating backup and recovery processes

Question 2

During IS audit planning, the concept of 'audit universe' refers to:

Accepted Answer

The complete inventory of auditable entities from which the audit plan is derived

Answer

All potential risks identified across the organization

Answer

The total number of staff available for audit work

Answer

The set of regulatory requirements applicable to the organization

Question 3

When should IS audit planning ideally begin relative to the audit fieldwork?

Accepted Answer

Well in advance to allow adequate preparation, risk assessment, and resource allocation

Answer

Immediately before fieldwork starts

Answer

After preliminary interviews with management are complete

Answer

Only after the prior audit's findings are remediated

Question 4

Which factor would MOST likely cause an IS auditor to increase the sample size during audit planning?

Accepted Answer

High control risk

Answer

Low population size

Answer

Low inherent risk

Answer

Strong prior audit results

Question 5

An IS auditor planning an audit of the software development lifecycle (SDLC) should PRIMARILY focus on which phase for the highest control risk?

Accepted Answer

Production deployment phase

Answer

Testing phase

Answer

Requirements gathering phase

Answer

Maintenance phase

Question 6

In the context of IS audit planning, 'scope creep' refers to:

Accepted Answer

Gradual expansion of audit scope beyond what was originally agreed, without corresponding adjustment of resources or timelines

Answer

The process of narrowing scope to focus on high-risk areas

Answer

Additional testing required when control deficiencies are found

Answer

Expanding the audit team mid-engagement

Question 7

Which of the following BEST describes a risk-based audit approach in IS audit planning?

Accepted Answer

Allocating audit resources to areas with the highest risk to achieve audit objectives efficiently

Answer

Auditing every system and process equally regardless of risk level

Answer

Focusing only on financial systems because they pose the most regulatory risk

Answer

Following a fixed template that does not change between audit cycles