CISA IS Audit Planning 5

Question 1

An IS auditor is planning an audit of an organization that recently implemented an AI-based fraud detection system. Which audit area deserves the MOST attention in the initial planning phase?

Accepted Answer

Algorithm bias, model validation, and governance of AI decision-making

Answer

Physical security of AI servers

Answer

Number of fraud alerts generated daily

Answer

Vendor support contract terms

Question 2

Which of the following scenarios BEST illustrates an inappropriate restriction on audit scope that an IS auditor should escalate?

Accepted Answer

Management requests the auditor avoid reviewing a specific high-risk system due to 'sensitivity'

Answer

Management provides a list of recommended contacts for interviews

Answer

The audit committee requests a focus on cybersecurity controls

Answer

Management asks for a preliminary briefing before the audit report is finalized

Question 3

During IS audit planning, the auditor reviews prior audit workpapers. The PRIMARY benefit of this review is to:

Accepted Answer

Understand previously identified risks, findings, and remediation status to inform current planning

Answer

Copy prior procedures to save planning time

Answer

Avoid duplication by skipping areas already tested

Answer

Confirm that prior auditors used appropriate methodologies

Question 4

Which IS audit planning concept ensures that audit conclusions are supported by sufficient, reliable, relevant, and useful evidence?

Accepted Answer

Audit evidence standards

Answer

Audit materiality

Answer

Audit independence

Answer

Audit risk model

Question 5

An IS auditor plans to rely on the work of an internal audit team. Which condition MUST be assessed before placing reliance on their work?

Accepted Answer

The competence and objectivity of the internal audit function

Answer

Whether the internal audit team reports to the CFO

Answer

Whether internal auditors use the same tools as external auditors

Answer

The number of years the internal audit team has been in place

Question 6

In IS audit planning, which approach helps an auditor identify control gaps by mapping risks to existing controls?

Accepted Answer

Control matrix (risk-control matrix)

Answer

Flowcharting

Answer

Data flow diagramming

Answer

Entity-relationship diagramming

Question 7

An IS auditor is planning an audit in an environment where management has implemented continuous monitoring tools. The auditor should PRIMARILY:

Accepted Answer

Evaluate the design and effectiveness of the continuous monitoring tools as part of the audit plan

Answer

Rely entirely on continuous monitoring results and skip independent testing

Answer

Assume controls are effective since continuous monitoring is in place

Answer

Replace audit sampling with management's monitoring reports