CISA IS Audit Planning 4

Question 1

An IS auditor notices that a key IT system has not been audited in three years. According to risk-based planning, this fact PRIMARILY affects which planning element?

Accepted Answer

Audit frequency prioritization

Answer

Detection risk

Answer

Residual risk

Answer

Control risk assessment

Question 2

During IS audit planning, which of the following is the BEST source for understanding an organization's IT risk posture?

Accepted Answer

The organization's enterprise risk management (ERM) framework and IT risk register

Answer

Prior year's financial statements

Answer

Vendor documentation for installed software

Answer

Industry benchmarking reports

Question 3

An IS auditor is planning an audit and must evaluate whether to use Computer-Assisted Audit Techniques (CAATs). The PRIMARY advantage of CAATs is:

Accepted Answer

They enable analysis of entire data populations rather than just samples

Answer

They eliminate the need for auditor judgment

Answer

They reduce the need for interviewing auditees

Answer

They ensure 100% accuracy of audit findings

Question 4

When planning an IS audit for a regulated financial institution, which external requirement should MOST influence the audit plan?

Accepted Answer

Applicable regulatory requirements and compliance mandates (e.g., FFIEC, SOX)

Answer

The organization's internal IT strategy document

Answer

Competitor audit practices

Answer

The IT vendor's recommended audit procedures

Question 5

Which of the following BEST describes the relationship between audit objectives and audit procedures in IS audit planning?

Accepted Answer

Audit objectives drive the design of audit procedures used to gather evidence

Answer

Audit procedures define the objectives the auditor wants to achieve

Answer

Audit procedures and objectives are developed independently

Answer

Audit objectives are set by the auditee, not the auditor

Question 6

During IS audit planning, an auditor reviews organizational charts and job descriptions. The PRIMARY purpose is to:

Accepted Answer

Understand segregation of duties and the assignment of IT responsibilities

Answer

Identify potential fraud perpetrators

Answer

Evaluate employee performance

Answer

Determine headcount for staffing risk assessment

Question 7

An IS auditor concludes that the planned audit cannot be completed within budget due to expanded scope. The auditor should FIRST:

Accepted Answer

Inform management and obtain approval for additional resources or a revised scope

Answer

Reduce testing in low-risk areas to compensate

Answer

Issue a qualified audit opinion due to resource constraints

Answer

Carry over remaining work to the next audit cycle without disclosure