Audit Reporting and Quality CISA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An IS auditor is writing the final report for an audit that identified a lack of segregation of duties in the change management process. The auditor wants to ensure the report is structured to facilitate management's response and remediation. Which section should the auditor include to directly support this goal?

   • AAn executive summary that only highlights the positive aspects of the audit
   • BA list of all employees involved in the change management process with their performance ratings
   • CA findings section that includes the condition, criteria, cause, and impact, followed by a recommendation and a management action plan
   • DA detailed technical explanation of the change management system's codebase
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After an audit of the IT procurement process, management agreed to implement a new vendor management system to address findings about inadequate vendor due diligence. The IS auditor is now responsible for follow-up. Which action is most appropriate for the auditor to take?

   • AReview the management action plan, track milestones, and verify that the system is implemented and operating effectively before closing the finding.
   • BImmediately close the finding because management has agreed to implement the system.
   • CWait until the next scheduled audit to check if the system was implemented.
   • DAsk the vendor to confirm that the system is implemented and close the finding based on that confirmation.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   The internal audit department has received feedback from audit clients that the audit reports are too long and difficult to understand. The CAE wants to improve the quality of reports. Which action is most likely to lead to sustainable improvement?

   • AInstruct auditors to write shorter reports by omitting detailed findings.
   • BRequire all auditors to use a standard template without any customization.
   • CAsk the audit committee to review every report before issuance and provide feedback.
   • DConduct a benchmarking study of audit report formats used by other organizations and adopt best practices.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which section of an IS audit report provides a high-level overview of the audit's purpose, key findings, and overall conclusion?

   • AManagement response
   • BAudit scope and methodology
   • CExecutive summary
   • DDetailed findings and recommendations
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An IS auditor is auditing a multinational company that operates in several countries with different data privacy regulations. The audit report will contain findings about personal data handling practices. The auditor is concerned about the legal implications of distributing the report across borders. Which action best balances the need to report findings with legal and regulatory constraints?

   • ADelay the report indefinitely until all data privacy laws are harmonized across countries.
   • BConsult with legal counsel to determine the appropriate distribution list and any necessary data protection measures, such as redaction or secure transmission.
   • CDistribute the report to all global stakeholders as usual, because internal audit reports are exempt from data privacy laws.
   • DRemove all personal data references from the report and distribute it globally without restriction.
   Reveal Solution Discussion Select an answer first