Audit Frameworks and Standards CISA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An IS auditor is performing an operational audit of a company's supply chain management system. The auditor discovers that the system has a critical vulnerability that could allow unauthorized access to sensitive supplier data. The auditor is unsure whether to report this immediately or wait for the final audit report. According to ISACA IS Audit Standards, what should the auditor do?

   • AReport the vulnerability to the external auditor instead of management.
   • BWait for the final audit report to include the vulnerability.
   • CInclude the vulnerability in the final report but do not mention it earlier.
   • DReport the critical vulnerability to management immediately, as required by the standards for significant findings.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An IS auditor is performing a risk assessment for a financial institution's new online banking platform. The auditor is unsure how to apply the ISACA IS Audit Standard on risk assessment in the context of a cloud-hosted service. Which resource should the auditor consult to interpret the standard and implement best practices?

   • AThe COBIT 2019 framework, which replaces ISACA IS Audit Standards for all audit work.
   • BThe vendor's security whitepapers, which are the authoritative source for audit procedures in cloud environments.
   • CThe ISACA IS Audit Guidelines, which provide detailed guidance on applying the standards in specific situations.
   • DThe organization's internal audit charter, which supersedes ISACA standards when conflicts arise.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During an audit, an IS auditor discovers that the company's IT manager has been approving vendor invoices that are not supported by purchase orders. The auditor plans to report this finding. However, the IT manager is also the auditor's direct supervisor. According to the ISACA Code of Professional Ethics, what should the auditor do?

   • ADiscuss the finding with the IT manager first and agree to omit it if the manager promises to correct the issue.
   • BComplete the audit and include the finding in the final report without any special handling.
   • CReport the finding to the next level of management or the audit committee, as appropriate.
   • DResign from the audit engagement to avoid the conflict of interest.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary role of ISACA IS Audit Guidelines in an audit engagement?

   • ATo help auditors interpret standards and implement best practices
   • BTo define the legal penalties for non-compliance with audit standards
   • CTo replace the need for audit planning and risk assessment
   • DTo provide mandatory rules that must be followed exactly
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which principle of the ISACA Code of Professional Ethics requires an IS auditor to refrain from disclosing confidential information without proper authority?

   • AProfessionalism
   • BObjectivity
   • CIntegrity
   • DConfidentiality
   Reveal Solution Discussion Select an answer first