Audit Planning and Risk Assessment CISA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a control gap?

   • AA control that has been tested and found effective
   • BA missing or inadequate control to address a specific risk
   • CA situation where a control is operating but not documented
   • DA control that is too costly to implement
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During the planning phase of an audit of a new customer relationship management (CRM) system, the auditor reviews the control design documentation. The documentation indicates that the system has a control to restrict access to customer data based on job role. However, the auditor discovers that the control is not configured to enforce segregation of duties for sales representatives who can both create and approve discounts. What should the auditor do NEXT?

   • AIgnore the issue because the access control is working as designed for the majority of users.
   • BProceed with the audit and test the access control as designed, noting the segregation of duties issue as a finding.
   • CDocument the control gap and consider it a design deficiency that may increase the risk of unauthorized discounts.
   • DRecommend that management immediately implement a new control to enforce segregation of duties before the audit proceeds.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which factor is most important when prioritizing audit engagements?

   • AThe age of the audit department
   • BThe number of auditors available
   • CThe risk level of the auditable entity
   • DThe preference of the audit committee chair
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   To whom should audit project status be reported during the audit?

   • ATo the audit committee and management as appropriate
   • BTo all employees of the organization
   • COnly to the external auditors
   • DTo the general public
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During an audit of a major system implementation, the audit team discovers that the project is behind schedule due to unexpected technical issues. The audit manager needs to communicate this to stakeholders. Which of the following is the MOST appropriate action?

   • AWait until the audit is complete and include the schedule delay in the final report.
   • BReport the schedule delay and its impact on the audit timeline to the appropriate stakeholders as soon as possible.
   • CAdjust the audit plan without informing stakeholders to avoid raising concerns.
   • DInform the audit committee immediately and recommend that the audit be terminated.
   Reveal Solution Discussion Select an answer first