CISA IS Audit Planning 3

Question 1

An IS auditor is planning an audit of a cloud-hosted ERP system. Which consideration is UNIQUE to cloud environments compared to on-premises systems?

Accepted Answer

Reliance on third-party audits such as SOC 2 reports to assess provider controls

Answer

In cloud environments, the auditor typically cannot directly test provider infrastructure controls and must rely on third-party assurance reports like SOC 2 Type II to evaluate those controls.

Question 2

During IS audit planning, the concept of 'audit universe' refers to:

Accepted Answer

The complete inventory of auditable entities from which the audit plan is derived

Answer

The audit universe is the comprehensive inventory of all auditable entities — systems, processes, departments — that forms the basis for developing a risk-based audit plan.

Question 3

When should IS audit planning ideally begin relative to the audit fieldwork?

Accepted Answer

Well in advance to allow adequate preparation, risk assessment, and resource allocation

Answer

Planning should begin well in advance of fieldwork to allow time for risk assessment, scoping, resource scheduling, and coordination with auditees.

Question 4

Which factor would MOST likely cause an IS auditor to increase the sample size during audit planning?

Accepted Answer

High control risk

Answer

High control risk means existing controls may not be effective, so the auditor needs a larger sample to gain sufficient confidence in the audit conclusions.

Question 5

An IS auditor planning an audit of the software development lifecycle (SDLC) should PRIMARILY focus on which phase for the highest control risk?

Accepted Answer

Production deployment phase

Answer

Production deployment is the highest-risk SDLC phase because unauthorized or untested code moving to production can directly impact business operations and data integrity.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA IS Audit Planning 3