Audit Planning and Risk Assessment CISA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An internal audit department is defining its audit universe for the first time. The organization is a mid-sized manufacturing company with multiple business units, including production, sales, and finance. The audit committee has requested that the audit plan focus on areas that could significantly impact the achievement of organizational objectives. Which of the following is the MOST appropriate first step in defining the audit universe?

   • AInclude only systems that have been audited in the past to ensure continuity and comparability.
   • BSelect the business units with the largest revenue and include only those in the audit universe.
   • CList all auditable entities, such as business processes, systems, and locations, and then map them to organizational objectives.
   • DAsk each business unit manager to submit a list of their top risks and use that as the audit universe.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In risk assessment, what does 'likelihood' refer to?

   • AThe probability that a risk event will occur
   • BThe number of controls in place to prevent a risk
   • CThe speed at which a risk can be mitigated
   • DThe potential financial loss if a risk occurs
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary factor in allocating audit resources effectively?

   • AThe number of audit tools available
   • BThe seniority of the audit staff
   • CThe personal preferences of the audit manager
   • DThe risk level of the audit area
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When allocating audit resources, which team skill is most critical for an audit of a complex IT system?

   • ATechnical expertise in the specific IT environment
   • BStrong writing skills
   • CExperience in marketing
   • DGeneral accounting knowledge
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An IT audit manager is conducting a risk assessment to prioritize audit engagements for the upcoming year. The organization has recently experienced a ransomware attack that encrypted critical file servers, and management has expressed concern about the effectiveness of backup and recovery procedures. The audit manager needs to evaluate the likelihood and impact of a similar attack recurring. Which technique would be MOST appropriate for this assessment?

   • APerform a quantitative risk analysis using historical loss data and statistical models to calculate annualized loss expectancy.
   • BReview the audit committee's risk appetite statement and assign a risk rating based solely on management's perception.
   • CUse a vulnerability scan of the file servers to identify technical weaknesses and assign a numeric risk score.
   • DConduct a qualitative risk assessment using a risk matrix that rates likelihood and impact based on expert judgment and the recent incident.
   Reveal Solution Discussion Select an answer first