Audit Frameworks and Standards CISA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An IS auditor is planning a compliance audit of a healthcare organization's patient data handling practices. The organization uses a third-party cloud provider for data storage. The auditor must ensure the audit meets ISACA IS Audit Standards. Which approach best addresses the standards' requirements while considering the third-party environment?

   • ARely solely on the cloud provider's ISO 27001 certification as proof of compliance.
   • BObtain the cloud provider's SOC 2 report and evaluate whether it provides sufficient evidence for the audit objectives.
   • CConduct the audit without considering the cloud provider, since the organization is ultimately responsible for compliance.
   • DRequest the cloud provider to allow the auditor to perform an on-site audit of their facilities.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During an audit of a software development company, an IS auditor discovers that the lead developer is a close personal friend. The auditor is concerned that this relationship could impair objectivity. According to the ISACA Code of Professional Ethics, what is the most appropriate course of action?

   • AComplete the audit and note the relationship in the final report as a matter of transparency.
   • BAsk the developer to sign a statement confirming no undue influence was exerted.
   • CDisclose the relationship to the audit manager and request reassignment to a different area of the audit.
   • DProceed with the audit but exclude the developer's work from the scope to avoid any appearance of bias.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of a risk assessment in an IS audit context?

   • ATo identify and evaluate risks that could affect the achievement of objectives
   • BTo ensure compliance with laws and regulations
   • CTo scan systems for known vulnerabilities
   • DTo test the effectiveness of security controls
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An IS auditor is planning an operational audit of a manufacturing company's inventory management process. The audit committee has asked the auditor to ensure the engagement is conducted with the same rigor as a financial statement audit. Which action best aligns the operational audit with ISACA IS Audit Standards?

   • AFocus exclusively on the IT systems supporting inventory, since operational audits are IT-centric.
   • BDocument the audit scope, objectives, and methodology in an engagement letter, and obtain management's acknowledgment.
   • CConduct the audit informally to avoid disrupting the manufacturing schedule, since it is not a regulatory requirement.
   • DRely solely on the external financial auditor's work papers to avoid duplication of effort.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An IS auditor is engaged to evaluate whether a hospital's patient record system complies with the Health Insurance Portability and Accountability Act (HIPAA) and also to assess the operational efficiency of the system's backup procedures. Which type of audit is the auditor performing?

   • ACompliance audit, since HIPAA is the primary regulatory requirement.
   • BIntegrated audit, combining compliance and operational objectives.
   • CFinancial audit, focusing on the accuracy of financial statements.
   • DOperational audit, since the focus is on backup procedures.
   Reveal Solution Discussion Select an answer first