Audit Frameworks and Standards CISA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An IS auditor is evaluating the effectiveness of the firewall configuration in a company's data center. The auditor is checking whether the firewall rules are aligned with the company's security policy and whether they are operating as intended. Which type of audit is the auditor performing?

   • AOperational audit
   • BFinancial audit
   • CIntegrated audit
   • DCompliance audit
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   The chief audit executive (CAE) of a multinational corporation wants to obtain an independent assessment of the internal audit function's compliance with the Institute of Internal Auditors (IIA) Standards and ISACA IS Audit Standards. Which type of review should the CAE arrange?

   • AManagement review
   • BControl self-assessment
   • CInternal quality assurance review
   • DExternal peer review
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   The internal audit director of a bank is planning a quality assurance review (QAR) of the IS audit function. The director wants the QAR to be conducted by an independent party. Which approach best meets the director's requirement for independence?

   • AAsk the external financial auditor to review the IS audit function's work papers.
   • BEngage an external firm with expertise in IS audit to conduct the QAR.
   • CAssign the QAR to a senior IS auditor within the same department.
   • DHave the IS audit team conduct a self-assessment.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A quality assurance review of an IS audit function is primarily intended to:

   • AEnsure that audit work is performed in accordance with professional standards
   • BEvaluate the performance of the audit client's management
   • CIdentify vulnerabilities in the audited systems
   • DDetermine the financial value of the audit function
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An IS auditor is performing a review of a company's IT governance framework. During the review, the auditor discovers that the CIO has been using company resources for personal projects. The auditor is a close friend of the CIO. According to the ISACA Code of Professional Ethics, what is the most appropriate course of action?

   • AAsk the CIO to stop the personal projects and then continue the review without further action.
   • BContinue the review but exclude the findings about the CIO from the final report to avoid personal embarrassment.
   • CComplete the review and report the findings, but note the personal relationship in the report.
   • DDisclose the conflict of interest to the audit manager and recuse oneself from the portion of the review involving the CIO.
   Reveal Solution Discussion Select an answer first