Information System Auditing Process Flashcards
7 cards from real ISACA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Information System Auditing Process flashcards as text
When an IS auditor identifies a control deficiency during fieldwork, what is the MOST appropriate immediate action?
Answer: Document the finding and discuss it with management before finalizing
Auditors should document findings and discuss them with management during the exit conference to confirm facts before issuing the final report.
Which sampling method gives every item in a population an equal chance of selection, making it the most statistically representative?
Answer: Random sampling
Random (statistical) sampling ensures each item has an equal probability of selection, supporting statistically valid conclusions.
An IS auditor is reviewing access controls and finds that 15% of sampled user accounts belong to terminated employees. This finding BEST represents a weakness in:
Answer: User access termination controls
Active accounts for terminated employees indicate a failure in the offboarding/access revocation process, which is a user access termination control.
What is the PRIMARY purpose of an audit charter?
Answer: To authorize the internal audit function and establish its responsibilities
The audit charter formally establishes the internal audit function's purpose, authority, and responsibility within the organization.
An IS auditor discovers evidence of fraud during a routine audit. What should the auditor do FIRST?
Answer: Immediately expand audit scope and notify appropriate management or legal counsel
Upon discovering potential fraud, the auditor should expand scope as needed and notify appropriate levels of management or legal counsel per established protocols.
Which technique involves IS auditors processing test transactions through a live system to verify controls without alerting operations staff?
Answer: Integrated Test Facility (ITF)
An Integrated Test Facility (ITF) embeds fictitious test entities within the production environment so auditors can test controls unobtrusively during normal operations.
The concept of 'materiality' in IS auditing PRIMARILY helps auditors to:
Answer: Determine which findings are significant enough to report
Materiality guides auditors in assessing whether a finding is significant enough to warrant reporting and affect the overall audit opinion.