CISA IT Audit Standards and Frameworks 3

Question 1

In IS auditing, 'audit risk' is composed of which three components?

Accepted Answer

Inherent risk, control risk, and detection risk

Answer

Operational risk, financial risk, and strategic risk

Answer

Residual risk, inherent risk, and risk appetite

Answer

Detection risk, compliance risk, and fraud risk

Question 2

Within ISACA's framework, which component provides IS auditors with specific step-by-step procedures for conducting an audit?

Accepted Answer

Tools and Techniques

Answer

Standards

Answer

Guidelines

Answer

Audit charters

Question 3

According to the COSO framework, internal control is best described as:

Accepted Answer

A process effected by an entity's board, management, and other personnel

Answer

A set of IT policies enforced by the IT department

Answer

Primarily a financial reporting mechanism

Answer

An automated system that prevents all fraud

Question 4

The COBIT 2019 management domain APO primarily deals with which activities?

Accepted Answer

Aligning IT strategy with business goals, planning IT resources, and organizing IT functions

Answer

Building and acquiring new IT systems

Answer

Delivering IT services and managing operations

Answer

Monitoring IT performance against business objectives

Question 5

ISACA's CRISC certification complements CISA by focusing on which specialized area?

Accepted Answer

IT risk identification and information systems control

Answer

Cloud infrastructure security

Answer

Cybersecurity incident response

Answer

Forensic auditing and investigation

Question 6

What is the primary purpose of IT governance frameworks such as COBIT for an organization?

Accepted Answer

To provide a common language and framework for aligning IT with business objectives

Answer

To replace internal audit and compliance functions entirely

Answer

To enforce specific regulatory compliance mandates

Answer

To automate IT operations and eliminate manual processes

Question 7

When ISO 27001 is implemented, the Plan-Do-Check-Act (PDCA) cycle is applied to:

Accepted Answer

Manage and continually improve the information security management system

Answer

Develop and test new software applications

Answer

Conduct network penetration testing engagements

Answer

Train employees on phishing awareness