Audit Planning and Risk Assessment CISA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of risk-based audit planning?

   • ATo ensure all audit areas receive equal attention regardless of risk
   • BTo focus audit resources on areas with the highest risk to the organization
   • CTo eliminate the need for detailed audit testing
   • DTo satisfy regulatory requirements for annual audits
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An IT audit manager is developing the annual audit plan. The organization has a high-risk legacy system that is scheduled for decommissioning in six months, but it still processes financial transactions. The audit committee has requested that the audit plan focus on emerging risks, including a new cloud migration project. The audit team has limited resources. Which of the following is the BEST approach to balance these priorities?

   • AAudit the cloud migration project now because it is an emerging risk, and rely on the decommissioning plan to mitigate legacy system risks.
   • BSplit the audit team equally between the two areas to ensure both are covered.
   • CConduct a risk assessment of both areas and allocate resources based on the combined likelihood and impact, considering the decommissioning timeline.
   • DAudit the legacy system now because it is high-risk, and defer the cloud migration audit to the following year.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An auditor is developing an audit program for a review of a new customer relationship management (CRM) system. The audit objective is to ensure that customer data is protected from unauthorized access. The system has role-based access control, but the auditor is concerned about segregation of duties for users who can both create and approve discounts. Which of the following is the MOST appropriate procedure to include in the audit program?

   • AInterview the system administrator to ask if segregation of duties is enforced.
   • BTest the system's password policy to ensure strong passwords are required.
   • CReview the access control configuration to identify users with conflicting roles and test whether the system prevents them from performing both functions.
   • DReview the audit log to identify any unauthorized access to customer data.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a key component of audit project management?

   • AWriting the final audit report
   • BDefining the audit scope
   • CConducting the opening meeting
   • DSelecting audit software
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which control classification is most likely to be tested by inspecting configuration settings?

   • AManual control
   • BAutomated control
   • CCompensating control
   • DIT-dependent control
   Reveal Solution Discussion Select an answer first