Audit Planning and Risk Assessment CISA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An IT audit manager is planning an audit of a critical financial system. The audit team consists of two senior auditors and one junior auditor. The audit is expected to take six weeks, but the manager has been informed that the system will undergo a major upgrade in four weeks, which will change the system's configuration. What is the MOST appropriate action for the audit manager?

   • AIncrease the audit team size to complete the audit before the upgrade.
   • BDefer the audit until after the upgrade is complete and the system is stable.
   • CProceed with the audit as planned and test the system after the upgrade to ensure the new configuration is audited.
   • DRevise the audit scope and timeline to focus on the pre-upgrade configuration and complete testing before the upgrade.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an example of a preventive control?

   • ARequiring two-factor authentication for system access
   • BReviewing system logs for unauthorized access attempts
   • CConducting a post-incident review to improve procedures
   • DRestoring data from backups after a ransomware attack
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which element is typically included in an audit program?

   • AThe audit procedures to be performed
   • BThe audit committee's meeting minutes
   • CThe organization's strategic plan
   • DThe names of all employees in the audited area
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An IT audit manager is assessing the risk of a new customer-facing web application that will process personal data. The application is being developed using agile methodology with frequent releases. The audit manager needs to determine the likelihood and impact of a data breach. The organization has a strong security testing program, but the rapid release cycle increases the risk of vulnerabilities. Which of the following is the MOST appropriate risk assessment approach?

   • AUse a quantitative model that calculates the annualized loss expectancy based on industry breach statistics.
   • BDefer the risk assessment until the application is stable and the release cycle slows down.
   • CRely on the results of the security testing program to determine that the risk is low and document that conclusion.
   • DConduct a scenario-based risk assessment that considers the likelihood of a breach given the agile release process and the impact of personal data exposure.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An internal audit department has a team of five auditors with varying skills. The annual audit plan includes a complex IT audit of a new ERP system, a routine financial audit, and a compliance audit for a new data privacy regulation. The audit manager needs to assign auditors to these engagements. Which of the following is the MOST effective resource allocation?

   • AAssign the most experienced IT auditor to the ERP audit, a financial auditor to the financial audit, and a compliance specialist to the privacy audit.
   • BAssign all auditors to the ERP audit first because it is the most complex and then move to the other audits.
   • CAssign the junior auditors to the ERP audit to provide them with challenging work, and the senior auditors to the routine financial audit.
   • DRotate auditors across all three audits to ensure everyone gains experience, regardless of skill match.
   Reveal Solution Discussion Select an answer first