An IS auditor is planning a risk assessment for a new customer relationship management (CRM) system. The auditor has identified several potential threats and vulnerabilities. To comply with ISACA IS Audit Standards, which step should the auditor take next?

Conduct a vulnerability assessment to identify system weaknesses.

Evaluate the likelihood and impact of each threat to prioritize risks.

Report the identified threats to management without further analysis.

Implement controls to mitigate all identified risks immediately.

What is the primary purpose of the ISACA IS Audit Standards?

To define the legal requirements for IS audits

To replace the need for auditor judgment in all situations

To offer optional best practices for audit efficiency

To provide a framework for audit quality and consistency in IS audits

What is the primary purpose of a management review in the context of IS audit?

To evaluate the performance of individual auditors

To verify the accuracy of financial statements

To test the technical security of the network

To assess whether management's oversight and decision-making are effective

Certified Information Systems Auditor

Domain 1Objective 1

Audit Frameworks and Standards CISA Practice Questions (Page 4)

Part of the Information Systems Auditing Process domain, which accounts for 18% of the CISA exam.

28questions here

6free pages

6concepts

18%of the exam

Questions 16–20

16foundation · easy
Which type of assessment is specifically designed to identify weaknesses in systems that could be exploited by attackers?
Select an answer first
17expert · hard
An IS auditor is planning a risk assessment for a new customer relationship management (CRM) system. The auditor has identified several potential threats and vulnerabilities. To comply with ISACA IS Audit Standards, which step should the auditor take next?
Select an answer first
18foundation · easy
What is the primary purpose of the ISACA IS Audit Standards?
Select an answer first
19application · medium
The internal audit director of a large bank wants to ensure that the IS audit team's work consistently meets professional standards and that the team's methodology is being followed correctly. Which type of review should the director initiate?
Select an answer first
20foundation · easy
What is the primary purpose of a management review in the context of IS audit?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.

Audit Frameworks and Standards CISA Practice Questions (Page 4)

Questions 16–20

Which type of assessment is specifically designed to identify weaknesses in systems that could be exploited by attackers?

An IS auditor is planning a risk assessment for a new customer relationship management (CRM) system. The auditor has identified several potential threats and vulnerabilities. To comply with ISACA IS Audit Standards, which step should the auditor take next?

What is the primary purpose of the ISACA IS Audit Standards?

The internal audit director of a large bank wants to ensure that the IS audit team's work consistently meets professional standards and that the team's methodology is being followed correctly. Which type of review should the director initiate?

What is the primary purpose of a management review in the context of IS audit?

Keep studying — Information Systems Auditing Process