ISACA Information System Auditing Process 2 — Questions and Answers
Question 1: When an IS auditor identifies a control deficiency during fieldwork, what is the MOST appropriate immediate action?
- Immediately report it to external regulators
- Document the finding and discuss it with management before finalizing (Correct answer)
- Include it in the audit report without informing management
- Dismiss it if it appears minor
Correct answer: Document the finding and discuss it with management before finalizing
Auditors should document findings and discuss them with management during the exit conference to confirm facts before issuing the final report.
Question 2: Which sampling method gives every item in a population an equal chance of selection, making it the most statistically representative?
- Judgmental sampling
- Stratified sampling
- Random sampling (Correct answer)
- Cluster sampling
Correct answer: Random sampling
Random (statistical) sampling ensures each item has an equal probability of selection, supporting statistically valid conclusions.
Question 3: An IS auditor is reviewing access controls and finds that 15% of sampled user accounts belong to terminated employees. This finding BEST represents a weakness in:
- Change management controls
- User access provisioning controls
- User access termination controls (Correct answer)
- Segregation of duties controls
Correct answer: User access termination controls
Active accounts for terminated employees indicate a failure in the offboarding/access revocation process, which is a user access termination control.
Question 4: What is the PRIMARY purpose of an audit charter?
- To define the detailed audit procedures for each engagement
- To authorize the internal audit function and establish its responsibilities (Correct answer)
- To communicate audit findings to senior management
- To assign specific tasks to individual auditors
Correct answer: To authorize the internal audit function and establish its responsibilities
The audit charter formally establishes the internal audit function's purpose, authority, and responsibility within the organization.
Question 5: An IS auditor discovers evidence of fraud during a routine audit. What should the auditor do FIRST?
- Confront the suspected employee directly
- Immediately expand audit scope and notify appropriate management or legal counsel (Correct answer)
- Complete the original audit scope before addressing the fraud
- Destroy the evidence to protect the organization
Correct answer: Immediately expand audit scope and notify appropriate management or legal counsel
Upon discovering potential fraud, the auditor should expand scope as needed and notify appropriate levels of management or legal counsel per established protocols.
Question 6: Which technique involves IS auditors processing test transactions through a live system to verify controls without alerting operations staff?
- Parallel simulation
- Integrated Test Facility (ITF) (Correct answer)
- Base case system evaluation
- Continuous auditing
Correct answer: Integrated Test Facility (ITF)
An Integrated Test Facility (ITF) embeds fictitious test entities within the production environment so auditors can test controls unobtrusively during normal operations.
Question 7: The concept of 'materiality' in IS auditing PRIMARILY helps auditors to:
- Determine which findings are significant enough to report (Correct answer)
- Calculate the total cost of identified control failures
- Select the appropriate auditing software tool
- Establish the timeline for audit fieldwork
Correct answer: Determine which findings are significant enough to report
Materiality guides auditors in assessing whether a finding is significant enough to warrant reporting and affect the overall audit opinion.
ISACA Information System Auditing Process 2
When an IS auditor identifies a control deficiency during fieldwork, what is the MOST appropriate immediate action?