Audit Reporting and Quality CISA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a component of a Quality Assurance and Improvement Program (QAIP) for an audit function?

   • AAnnual performance reviews of all auditees
   • BExternal assessments conducted at least every five years
   • CMandatory use of a single audit methodology for all audits
   • DA requirement to audit all high-risk areas annually
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An IS auditor is following up on a finding that required the implementation of multi-factor authentication (MFA) for remote access. Management has reported that MFA is now enabled. The auditor wants to verify the remediation. Which action provides the most reliable evidence?

   • AAsk a few employees if they use MFA when working remotely.
   • BReview the configuration of the remote access server to confirm that MFA is enforced.
   • CAccept management's report because they have a good track record of implementing fixes.
   • DCheck the audit trail of the remote access system for MFA prompts.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   The internal audit department is implementing a QAIP. The CAE wants to ensure that the program includes a mechanism for continuous improvement. Which component is essential for this purpose?

   • AA policy that requires all audits to be completed within a fixed number of days.
   • BA process for collecting and analyzing feedback from audit clients and stakeholders.
   • CA database of audit findings that is updated after each audit.
   • DA requirement that all audit reports be reviewed by the CAE before issuance.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An IS auditor is preparing the final report for an audit of a financial institution's core banking system. The audit uncovered a critical vulnerability that could allow unauthorized access to customer accounts. The auditor has drafted the report and is now determining the appropriate distribution list. Which action best aligns with audit reporting standards and regulatory requirements?

   • APublish the report on the organization's internal website so that all employees can access the findings and take corrective action.
   • BSend the report to the audit committee and the board of directors, as well as to the IT manager, in accordance with the organization's reporting policy.
   • CProvide the report to external regulators first, before any internal stakeholders, to ensure compliance with legal requirements.
   • DDistribute the report only to the IT manager responsible for the system to avoid unnecessary exposure of sensitive details.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An IS auditor is preparing the final report for an audit of a cloud migration project. The audit found that the project team did not follow the approved change management process for several configuration changes. The project manager argues that the changes were necessary to meet a tight deadline and that no issues have occurred. The auditor needs to communicate the finding objectively. Which approach is best?

   • AInclude the finding, but state that the changes were justified by the deadline and pose no risk.
   • BInclude the finding, describe the deviation from the approved process, and note the project manager's rationale, but also state the potential risks of unapproved changes.
   • CAcknowledge the project manager's argument and remove the finding from the report to maintain a good relationship.
   • DReport the finding only to the project manager privately and exclude it from the formal report.
   Reveal Solution Discussion Select an answer first