Audit Planning and Risk Assessment CISA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which risk assessment technique uses a matrix to plot the likelihood and impact of risks?

   • ARisk heat map
   • BCost-benefit analysis
   • CRoot cause analysis
   • DSWOT analysis
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which step is typically the first in the risk-based audit planning process?

   • AIdentifying and assessing risks across the organization
   • BDeveloping detailed audit procedures
   • CAllocating audit staff to engagements
   • DReporting audit results to management
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of an audit program?

   • ATo record the final audit findings and recommendations
   • BTo document the audit procedures and objectives
   • CTo assign audit staff to the engagement
   • DTo communicate audit results to stakeholders
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A multinational company is building its annual IT audit plan. The audit committee wants to ensure that limited audit resources are directed to the areas of greatest potential impact. The company has a new cloud-based customer relationship management (CRM) system that processes credit card payments, a legacy on-premises payroll system scheduled for decommissioning next year, and a recently implemented network segmentation project. Which of the following is the BEST approach for prioritizing these audit areas?

   • AAudit the cloud CRM system first because it processes credit card payments, making it subject to regulatory requirements and high inherent risk.
   • BAudit all three areas equally because each represents a significant change or legacy operation that requires coverage.
   • CAudit the network segmentation project first because it is the most recent change and therefore the highest risk.
   • DAudit the legacy payroll system first because it has been in operation the longest and may have accumulated control deficiencies.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An auditor is developing an audit program for a review of the change management process for a critical application. The audit objective is to determine whether changes are authorized, tested, and approved before implementation. Which of the following procedures should be included in the audit program?

   • ACompare the application's current version to the vendor's latest release to identify unpatched vulnerabilities.
   • BInterview the change manager to understand the process and ask if changes are authorized and tested.
   • CReview a sample of change requests to verify that each change has documented authorization, testing, and approval.
   • DTest the application's access controls to ensure only authorized users can initiate changes.
   Reveal Solution Discussion Select an answer first