CISA IS Audit Planning 4

Question 1

An IS auditor notices that a key IT system has not been audited in three years. According to risk-based planning, this fact PRIMARILY affects which planning element?

Accepted Answer

Audit frequency prioritization

Answer

A long gap since the last audit increases the priority of that system in audit frequency planning, as unaudited areas may have accumulated undetected risks.

Question 2

During IS audit planning, which of the following is the BEST source for understanding an organization's IT risk posture?

Accepted Answer

The organization's enterprise risk management (ERM) framework and IT risk register

Answer

The ERM framework and IT risk register document the organization's identified risks, their likelihood and impact, and existing mitigations — making them the primary source for risk-based audit planning.

Question 3

An IS auditor is planning an audit and must evaluate whether to use Computer-Assisted Audit Techniques (CAATs). The PRIMARY advantage of CAATs is:

Accepted Answer

They enable analysis of entire data populations rather than just samples

Answer

CAATs allow auditors to analyze complete data populations rather than relying on samples, providing greater coverage and statistical confidence in findings.

Question 4

When planning an IS audit for a regulated financial institution, which external requirement should MOST influence the audit plan?

Accepted Answer

Applicable regulatory requirements and compliance mandates (e.g., FFIEC, SOX)

Answer

Regulatory requirements define mandatory compliance areas that must be covered in the audit plan, taking precedence over internal preferences or vendor guidance.

Question 5

Which of the following BEST describes the relationship between audit objectives and audit procedures in IS audit planning?

Accepted Answer

Audit objectives drive the design of audit procedures used to gather evidence

Answer

Audit objectives define what the auditor seeks to determine, and audit procedures are then designed specifically to gather the evidence needed to meet those objectives.

CISA - Certified Information Systems Auditor Practice Test

CISA - Certified Information Systems Auditor Practice Test

CISA IS Audit Planning 4